CVE-2024-26040: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-26040. The vulnerability was discovered and disclosed on March 18, 2024, with Adobe Systems Incorporated serving as the assigning CNA (NVD).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue (CWE-79) that allows attackers to inject malicious scripts into vulnerable form fields. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (Adobe Advisory).

When exploited, the vulnerability allows malicious JavaScript to be executed in a victim's browser when they browse to a page containing the vulnerable field. This can lead to potential compromise of user data and browser-based attacks (NVD).

The vulnerability requires low attack complexity but needs low privileges and user interaction for successful exploitation. The attack vector is network-accessible (Adobe Advisory).

Adobe has addressed this vulnerability in Experience Manager version 6.5.20.0 and AEM Cloud Service version 2024.3.0. Users are advised to update to these versions or later to mitigate the risk (NVD).