CVE-2024-26054: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2024-26054 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.20 and earlier. The vulnerability was discovered and disclosed in June 2024, with Adobe Systems Incorporated serving as the assigning CNA (NVD, CVE).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into vulnerable form fields. The CVSS v3.1 base score is 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, required privileges, and user interaction (Adobe Advisory).

When exploited, this vulnerability allows malicious JavaScript to be executed in a victim's browser when they browse to a page containing the vulnerable field. The impact is rated as low for both confidentiality and integrity, with no impact on availability (NVD).

The vulnerability requires low attack complexity but does need low-level privileges and user interaction to be exploited. The attacker needs network access to the target system to attempt exploitation (Adobe Advisory).

Adobe has addressed this vulnerability in versions after 6.5.20. Users are advised to update their Adobe Experience Manager installations to the latest version to mitigate this security risk (Adobe Advisory).