CVE-2026-27288 is a DOM-based Cross-Site Scripting vulnerability affecting Adobe Experience Manager versions 6.5.24, FP11.7 and earlier, which allows attackers to execute malicious JavaScript within a victim's browser by manipulating the Document Object Model. The vulnerability requires user interaction, as victims must visit a specially crafted webpage to be exploited. With a CVSS score of 5.4 (Medium severity), the attack has a network-based vector with low complexity and requires low privileges, resulting in limited confidentiality and integrity impacts with no availability impact. Exploitation status indicates this vulnerability is not currently being actively exploited in the wild, as it does not appear on the Known Exploited Vulnerabilities (KEV) catalog, the Hot List is inactive, and EPSS scoring reflects minimal real-world exploitation probability. Organizations running affected Adobe Experience Manager versions should nevertheless prioritize patching to versions after 6.5.24 and FP11.7 to eliminate user-facing XSS attack vectors.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 6.5.24.0CPE matchmatch criteria | cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:* | ||
< 6.5.11.8CPE matchmatch criteria | cpe:2.3:a:adobe:experience_manager_screens:*:*:*:*:-:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.