CVE-2026-27288 — Cross-site Scripting in Adobe Experience Manager

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
5.4MEDIUMNVD
EPSS
0.0%
top 91.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Adobe Experience Manager
Timeline
PublishedApr 14

Description

Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages1 packages

🔴Vulnerability Details

3
VulDB
Adobe Experience Manager up to FP11.7 form cross site scripting (apsb26-34)↗2026-04-14
▶
GHSA
GHSA-m4p2-m73g-c9h4: Adobe Experience Manager versions FP11↗2026-04-14
▶
CVEList
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)↗2026-04-14
▶
CVE-2026-27288 — Cross-site Scripting in Adobe | cvebase