Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage.
References
| Link | Resource |
|---|---|
| https://helpx.adobe.com/security/products/aem-screens/apsb26-34.html | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
15 Apr 2026, 19:46
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:adobe:experience_manager_screens:*:*:*:*:-:*:*:* cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:* |
|
| First Time |
Adobe
Adobe experience Manager Adobe experience Manager Screens |
|
| References | () https://helpx.adobe.com/security/products/aem-screens/apsb26-34.html - Vendor Advisory |
14 Apr 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. |
14 Apr 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-14 18:16
Updated : 2026-06-17 10:26
NVD link : CVE-2026-27288
Mitre link : CVE-2026-27288
CVE.ORG link : CVE-2026-27288
JSON object : View
Products Affected
adobe
- experience_manager
- experience_manager_screens
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')