{"id":"CVE-2026-123258","kind":"vulnerability","aliases":["CVE-2026-123258"],"related":[],"title":"Adobe Experience Manager: DOM-based XSS lets a crafted page run scripts","description":"Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.","summary":"Adobe Experience Manager has a DOM-based cross-site scripting flaw. A victim who visits a crafted webpage can have attacker-supplied JavaScript run in their browser session.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Experience Manager","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe-experience-manager","vendor","web-frontend"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T22:18:29+00:00","first_seen_at":"2026-11-10T22:27:28+00:00","triaged_at":"2026-11-10T22:30:47+00:00","updated_at":"2026-11-10T22:30:47+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-10T22:30:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Adobe Experience Manager: DOM-based XSS lets a crafted page run scripts","impact":"medium","summary":"Adobe Experience Manager has a DOM-based cross-site scripting flaw. A victim who visits a crafted webpage can have attacker-supplied JavaScript run in their browser session.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["adobe-experience-manager","web-frontend"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Scripts run in victim browser sessions on the AEM site","analyst_note":"Check Adobe's security bulletin for affected AEM versions and fixed releases; the NVD entry gives none.","how_to_check":"unknown","plain_action":"","product_name":"Adobe Experience Manager","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Adobe Experience Manager whose pages or users can be lured to a crafted link. The sources do not list affected versions or the specific configuration that makes a deployment exposed.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000682,"input_tokens":4579,"output_tokens":449,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123258':16A,19A '-2026':15A,18A 'adob':1A,24B,31B,62C 'adobe':20A 'adobe-experience-manag':23B 'affect':66C 'attack':54B,79C 'attacker-suppli':53B 'base':6A,38B,71C 'browser':60B,100C 'chang':119C 'context':95C 'could':80C 'craft':10A,49B,115C 'cross':40B,73C 'cross-sit':39B,72C 'cve':14A,17A 'dom':5A,37B,70C,87C 'dom-bas':4A,36B,69C 'environ':88C 'execut':90C 'experi':2A,25B,32B,63C 'experience':21A 'exploit':81C,101C 'flaw':43B 'frontend':30B 'interact':107C 'issu':83C,104C 'javascript':56B,92C 'let':8A 'malici':91C 'manag':3A,26B,33B,64C 'manager':22A 'manipul':85C 'must':112C 'page':11A 'requir':105C 'run':12A,57B 'scope':117C 'script':13A,42B,75C 'session':61B 'site':41B,74C 'suppli':55B 'user':106C 'vendor':27B 'victim':45B,98C,111C 'visit':47B,113C 'vulner':77C 'web':29B 'web-frontend':28B 'webpag':50B,116C 'within':93C 'xss':7A,76C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Adobe Experience Manager whose pages or users can be lured to a crafted link. The sources do not list affected versions or the specific configuration that makes a deployment exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["adobeexperiencemanager","experiencemanager"],"ptokens":["adobe","experience","manager"],"labels":["adobeexperiencemanager","medium","vendor","webfrontend"],"campaign_type":null,"search_a":"'-123258':16A,19A '-2026':15A,18A 'adob':1A 'adobe':20A 'base':6A 'craft':10A 'cve':14A,17A 'dom':5A 'dom-bas':4A 'experi':2A 'experience':21A 'let':8A 'manag':3A 'manager':22A 'page':11A 'run':12A 'script':13A 'xss':7A","search_b":"'adob':24B,31B 'adobe-experience-manag':23B 'attack':54B 'attacker-suppli':53B 'base':38B 'browser':60B 'craft':49B 'cross':40B 'cross-sit':39B 'dom':37B 'dom-bas':36B 'experi':25B,32B 'flaw':43B 'frontend':30B 'javascript':56B 'manag':26B,33B 'run':57B 'script':42B 'session':61B 'site':41B 'suppli':55B 'vendor':27B 'victim':45B 'visit':47B 'web':29B 'web-frontend':28B 'webpag':50B","search_c":"'adob':62C 'affect':66C 'attack':79C 'base':71C 'browser':100C 'chang':119C 'context':95C 'could':80C 'craft':115C 'cross':73C 'cross-sit':72C 'dom':70C,87C 'dom-bas':69C 'environ':88C 'execut':90C 'experi':63C 'exploit':81C,101C 'interact':107C 'issu':83C,104C 'javascript':92C 'malici':91C 'manag':64C 'manipul':85C 'must':112C 'requir':105C 'scope':117C 'script':75C 'site':74C 'user':106C 'victim':98C,111C 'visit':113C 'vulner':77C 'webpag':116C 'within':93C 'xss':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123258","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123258","severity":null,"published_at":"2026-11-10T22:18:29+00:00","modified_at":"2026-11-10T22:18:29+00:00","first_seen_at":"2026-11-10T22:27:28+00:00","fetched_at":"2026-11-10T22:27:28+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}