{"id":"CVE-2026-118480","kind":"vulnerability","aliases":["CVE-2026-118480"],"related":[],"title":"Adobe Experience Manager: DOM-based XSS lets a crafted page run scripts","description":"Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.","summary":"Adobe Experience Manager has a DOM-based cross-site scripting flaw. A victim who visits a crafted webpage can have attacker-supplied JavaScript run in their browser session.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["adobe-experience-manager","self-hosted","vendor"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T22:18:23+00:00","first_seen_at":"2026-11-10T22:27:26+00:00","triaged_at":"2026-11-10T22:30:51+00:00","updated_at":"2026-11-10T22:30:51+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-10T22:30:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Adobe Experience Manager: DOM-based XSS lets a crafted page run scripts","impact":"medium","summary":"Adobe Experience Manager has a DOM-based cross-site scripting flaw. A victim who visits a crafted webpage can have attacker-supplied JavaScript run in their browser session.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["adobe-experience-manager","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker scripts run in victim browser sessions on the AEM site","analyst_note":"Check Adobe's security bulletin for CVE-2026-118480 for affected versions and the fixed release; the NVD entry alone does not state them.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations that run Adobe Experience Manager and expose its pages to users who browse the web. The sources do not name affected versions or specific configurations. unknown","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000668,"input_tokens":4579,"output_tokens":420,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118480':16A,19A '-2026':15A,18A 'adob':1A,21B,28B,59C 'adobe-experience-manag':20B 'affect':63C 'attack':51B,76C 'attacker-suppli':50B 'base':6A,35B,68C 'browser':57B,97C 'chang':116C 'context':92C 'could':77C 'craft':10A,46B,112C 'cross':37B,70C 'cross-sit':36B,69C 'cve':14A,17A 'dom':5A,34B,67C,84C 'dom-bas':4A,33B,66C 'environ':85C 'execut':87C 'experi':2A,22B,29B,60C 'exploit':78C,98C 'flaw':40B 'host':26B 'interact':104C 'issu':80C,101C 'javascript':53B,89C 'let':8A 'malici':88C 'manag':3A,23B,30B,61C 'manipul':82C 'must':109C 'page':11A 'requir':102C 'run':12A,54B 'scope':114C 'script':13A,39B,72C 'self':25B 'self-host':24B 'session':58B 'site':38B,71C 'suppli':52B 'user':103C 'vendor':27B 'victim':42B,95C,108C 'visit':44B,110C 'vulner':74C 'webpag':47B,113C 'within':90C 'xss':7A,73C","nicknames":[],"mitigations":[],"who_affected":"Organizations that run Adobe Experience Manager and expose its pages to users who browse the web. The sources do not name affected versions or specific configurations. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["adobeexperiencemanager","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-118480':16A,19A '-2026':15A,18A 'adob':1A 'base':6A 'craft':10A 'cve':14A,17A 'dom':5A 'dom-bas':4A 'experi':2A 'let':8A 'manag':3A 'page':11A 'run':12A 'script':13A 'xss':7A","search_b":"'adob':21B,28B 'adobe-experience-manag':20B 'attack':51B 'attacker-suppli':50B 'base':35B 'browser':57B 'craft':46B 'cross':37B 'cross-sit':36B 'dom':34B 'dom-bas':33B 'experi':22B,29B 'flaw':40B 'host':26B 'javascript':53B 'manag':23B,30B 'run':54B 'script':39B 'self':25B 'self-host':24B 'session':58B 'site':38B 'suppli':52B 'vendor':27B 'victim':42B 'visit':44B 'webpag':47B","search_c":"'adob':59C 'affect':63C 'attack':76C 'base':68C 'browser':97C 'chang':116C 'context':92C 'could':77C 'craft':112C 'cross':70C 'cross-sit':69C 'dom':67C,84C 'dom-bas':66C 'environ':85C 'execut':87C 'experi':60C 'exploit':78C,98C 'interact':104C 'issu':80C,101C 'javascript':89C 'malici':88C 'manag':61C 'manipul':82C 'must':109C 'requir':102C 'scope':114C 'script':72C 'site':71C 'user':103C 'victim':95C,108C 'visit':110C 'vulner':74C 'webpag':113C 'within':90C 'xss':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118480","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118480","severity":null,"published_at":"2026-11-10T22:18:23+00:00","modified_at":"2026-11-10T22:18:23+00:00","first_seen_at":"2026-11-10T22:27:26+00:00","fetched_at":"2026-11-10T22:27:26+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}