{"id":"CVE-2026-118197","kind":"vulnerability","aliases":["CVE-2026-118197"],"related":[],"title":"Adobe Experience Manager: DOM-based XSS lets a crafted page run scripts","description":"Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.","summary":"Adobe Experience Manager has a DOM-based cross-site scripting flaw that lets an attacker run malicious JavaScript in a victim's browser. The victim must visit a crafted webpage for the attack to work.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["adobe-experience-manager","self-hosted","vendor"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T22:18:23+00:00","first_seen_at":"2026-11-10T22:27:25+00:00","triaged_at":"2026-11-10T22:30:54+00:00","updated_at":"2026-11-10T22:30:54+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-10T22:30:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Adobe Experience Manager: DOM-based XSS lets a crafted page run scripts","impact":"medium","summary":"Adobe Experience Manager has a DOM-based cross-site scripting flaw that lets an attacker run malicious JavaScript in a victim's browser. The victim must visit a crafted webpage for the attack to work.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["adobe-experience-manager","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs scripts in a victim's browser session on the site","analyst_note":"Find Adobe's security bulletin for CVE-2026-118197 to get affected versions, fixed versions and any mitigation.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organisations that run Adobe Experience Manager and serve pages to users who could be sent a crafted link. The sources do not name affected versions or configurations, so exposure cannot be confirmed from them.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000676,"input_tokens":4579,"output_tokens":437,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118197':16A,19A '-2026':15A,18A 'adob':1A,21B,28B,65C 'adobe-experience-manag':20B 'affect':69C 'attack':44B,62B,82C 'base':6A,35B,74C 'browser':52B,103C 'chang':122C 'context':98C 'could':83C 'craft':10A,58B,118C 'cross':37B,76C 'cross-sit':36B,75C 'cve':14A,17A 'dom':5A,34B,73C,90C 'dom-bas':4A,33B,72C 'environ':91C 'execut':93C 'experi':2A,22B,29B,66C 'exploit':84C,104C 'flaw':40B 'host':26B 'interact':110C 'issu':86C,107C 'javascript':47B,95C 'let':8A,42B 'malici':46B,94C 'manag':3A,23B,30B,67C 'manipul':88C 'must':55B,115C 'page':11A 'requir':108C 'run':12A,45B 'scope':120C 'script':13A,39B,78C 'self':25B 'self-host':24B 'site':38B,77C 'user':109C 'vendor':27B 'victim':50B,54B,101C,114C 'visit':56B,116C 'vulner':80C 'webpag':59B,119C 'within':96C 'work':64B 'xss':7A,79C","nicknames":[],"mitigations":[],"who_affected":"Organisations that run Adobe Experience Manager and serve pages to users who could be sent a crafted link. The sources do not name affected versions or configurations, so exposure cannot be confirmed from them.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["adobeexperiencemanager","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-118197':16A,19A '-2026':15A,18A 'adob':1A 'base':6A 'craft':10A 'cve':14A,17A 'dom':5A 'dom-bas':4A 'experi':2A 'let':8A 'manag':3A 'page':11A 'run':12A 'script':13A 'xss':7A","search_b":"'adob':21B,28B 'adobe-experience-manag':20B 'attack':44B,62B 'base':35B 'browser':52B 'craft':58B 'cross':37B 'cross-sit':36B 'dom':34B 'dom-bas':33B 'experi':22B,29B 'flaw':40B 'host':26B 'javascript':47B 'let':42B 'malici':46B 'manag':23B,30B 'must':55B 'run':45B 'script':39B 'self':25B 'self-host':24B 'site':38B 'vendor':27B 'victim':50B,54B 'visit':56B 'webpag':59B 'work':64B","search_c":"'adob':65C 'affect':69C 'attack':82C 'base':74C 'browser':103C 'chang':122C 'context':98C 'could':83C 'craft':118C 'cross':76C 'cross-sit':75C 'dom':73C,90C 'dom-bas':72C 'environ':91C 'execut':93C 'experi':66C 'exploit':84C,104C 'interact':110C 'issu':86C,107C 'javascript':95C 'malici':94C 'manag':67C 'manipul':88C 'must':115C 'requir':108C 'scope':120C 'script':78C 'site':77C 'user':109C 'victim':101C,114C 'visit':116C 'vulner':80C 'webpag':119C 'within':96C 'xss':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118197","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118197","severity":null,"published_at":"2026-11-10T22:18:23+00:00","modified_at":"2026-11-10T22:18:23+00:00","first_seen_at":"2026-11-10T22:27:25+00:00","fetched_at":"2026-11-10T22:27:25+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}