---
id: "CVE-2026-118197"
page: "https://infrastack.ai/live/CVE-2026-118197"
kind: "vulnerability"
aliases: ["CVE-2026-118197"]
title: "Adobe Experience Manager: DOM-based XSS lets a crafted page run scripts"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["adobe-experience-manager", "self-hosted", "vendor"]
not_affected_if: []
published_at: "2026-11-10T22:18:23+00:00"
first_seen_at: "2026-11-10T22:27:25+00:00"
updated_at: "2026-11-10T22:30:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118197", "first_seen_at": "2026-11-10T22:27:25+00:00"}]
exploit_sources: []
---

# Adobe Experience Manager: DOM-based XSS lets a crafted page run scripts

Link for people: https://infrastack.ai/live/CVE-2026-118197 (this .md is for agents)

Adobe Experience Manager has a DOM-based cross-site scripting flaw that lets an attacker run malicious JavaScript in a victim's browser. The victim must visit a crafted webpage for the attack to work.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T22:27:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118197

## From the sources

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_