CVE-2024-26046: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager (AEM) versions 6.5.19 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-26046. The vulnerability was discovered and disclosed on April 10, 2024, affecting the form field functionality in AEM installations (Adobe Advisory).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue (CWE-79) that allows attackers to inject malicious scripts into vulnerable form fields. The CVSS v3.1 base score is 5.4 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating that the attack requires network access, low attack complexity, low privileges, and user interaction (NVD).

When successfully exploited, the vulnerability allows malicious JavaScript to be executed in a victim's browser when they browse to the page containing the vulnerable field. This can lead to potential data theft, session hijacking, or other client-side attacks (Adobe Advisory).

The vulnerability requires an attacker to have low-level privileges and the ability to inject malicious scripts into form fields. User interaction is required as the victim must browse to the page containing the compromised field for the exploit to be successful (NVD).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Experience Manager to mitigate this security risk (Adobe Advisory).

The vulnerability was discovered and reported by security researcher Akshay Sharma (anonymous_blackzero) through Adobe's private bug bounty program with HackerOne (Adobe Advisory).