{"id":"CVE-2026-118479","kind":"vulnerability","aliases":["CVE-2026-118479"],"related":[],"title":"Adobe Experience Manager: DOM-based XSS lets attackers run scripts in visitors' browsers","description":"Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.","summary":"Adobe Experience Manager has a DOM-based cross-site scripting flaw. A victim who visits a crafted webpage can have malicious JavaScript run in their browser session.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["adobe-experience-manager","infrastructure","web"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T22:18:23+00:00","first_seen_at":"2026-11-10T22:27:26+00:00","triaged_at":"2026-11-10T22:30:52+00:00","updated_at":"2026-11-10T22:30:52+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T22:30:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Adobe Experience Manager: DOM-based XSS lets attackers run scripts in visitors' browsers","impact":"medium","summary":"Adobe Experience Manager has a DOM-based cross-site scripting flaw. A victim who visits a crafted webpage can have malicious JavaScript run in their browser session.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["adobe-experience-manager","web"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Malicious scripts run in victims' browsers, exposing their session data.","analyst_note":"Find the affected AEM versions and fixed release from Adobe's security bulletin; the NVD entry alone does not list them.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations that run Adobe Experience Manager and serve pages to users. The sources do not name affected versions or configurations, so exposure cannot be confirmed from them.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000667,"input_tokens":4579,"output_tokens":419,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118479':17A,20A '-2026':16A,19A 'adob':1A,22B,27B,56C 'adobe-experience-manag':21B 'affect':60C 'attack':9A,73C 'base':6A,34B,65C 'browser':14A,54B,94C 'chang':113C 'context':89C 'could':74C 'craft':45B,109C 'cross':36B,67C 'cross-sit':35B,66C 'cve':15A,18A 'dom':5A,33B,64C,81C 'dom-bas':4A,32B,63C 'environ':82C 'execut':84C 'experi':2A,23B,28B,57C 'exploit':75C,95C 'flaw':39B 'infrastructur':25B 'interact':101C 'issu':77C,98C 'javascript':50B,86C 'let':8A 'malici':49B,85C 'manag':3A,24B,29B,58C 'manipul':79C 'must':106C 'requir':99C 'run':10A,51B 'scope':111C 'script':11A,38B,69C 'session':55B 'site':37B,68C 'user':100C 'victim':41B,92C,105C 'visit':43B,107C 'visitor':13A 'vulner':71C 'web':26B 'webpag':46B,110C 'within':87C 'xss':7A,70C","nicknames":[],"mitigations":[],"who_affected":"Organizations that run Adobe Experience Manager and serve pages to users. The sources do not name affected versions or configurations, so exposure cannot be confirmed from them.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["adobeexperiencemanager","infrastructure","medium","web"],"campaign_type":null,"search_a":"'-118479':17A,20A '-2026':16A,19A 'adob':1A 'attack':9A 'base':6A 'browser':14A 'cve':15A,18A 'dom':5A 'dom-bas':4A 'experi':2A 'let':8A 'manag':3A 'run':10A 'script':11A 'visitor':13A 'xss':7A","search_b":"'adob':22B,27B 'adobe-experience-manag':21B 'base':34B 'browser':54B 'craft':45B 'cross':36B 'cross-sit':35B 'dom':33B 'dom-bas':32B 'experi':23B,28B 'flaw':39B 'infrastructur':25B 'javascript':50B 'malici':49B 'manag':24B,29B 'run':51B 'script':38B 'session':55B 'site':37B 'victim':41B 'visit':43B 'web':26B 'webpag':46B","search_c":"'adob':56C 'affect':60C 'attack':73C 'base':65C 'browser':94C 'chang':113C 'context':89C 'could':74C 'craft':109C 'cross':67C 'cross-sit':66C 'dom':64C,81C 'dom-bas':63C 'environ':82C 'execut':84C 'experi':57C 'exploit':75C,95C 'interact':101C 'issu':77C,98C 'javascript':86C 'malici':85C 'manag':58C 'manipul':79C 'must':106C 'requir':99C 'scope':111C 'script':69C 'site':68C 'user':100C 'victim':92C,105C 'visit':107C 'vulner':71C 'webpag':110C 'within':87C 'xss':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118479","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118479","severity":null,"published_at":"2026-11-10T22:18:23+00:00","modified_at":"2026-11-10T22:18:23+00:00","first_seen_at":"2026-11-10T22:27:26+00:00","fetched_at":"2026-11-10T22:27:26+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}