CVE-2024-26033: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-26033. The vulnerability was discovered and disclosed in March 2024, with Adobe Systems Incorporated being the assigning CNA (NVD, CVE).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue (CWE-79) that could allow an attacker to inject malicious scripts into vulnerable form fields. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility with low attack complexity, requiring low privileges and user interaction (NVD).

When successfully exploited, the vulnerability allows malicious JavaScript to be executed in a victim's browser when they browse to the page containing the vulnerable field. This could potentially lead to unauthorized data access or manipulation within the context of the affected user's session (CIS Advisory).

As of March 2024, there are no reports of this vulnerability being exploited in the wild. The vulnerability requires low privileges and user interaction to be exploited, making it a potential target for attackers seeking to compromise Adobe Experience Manager installations (CIS Advisory).

Adobe has released security updates to address this vulnerability. Organizations are advised to update their Adobe Experience Manager installations to versions later than 6.5.19.0. The fix is available through Adobe's security bulletin (Adobe Security).