CVE-2024-26062: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-26062. This vulnerability was discovered and reported by Adobe Systems Incorporated, with the initial CVE assignment date of February 14, 2024 (CVE Details).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) that could allow an attacker to inject malicious scripts into vulnerable form fields. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

When successfully exploited, malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. This could potentially lead to unauthorized access to user data, session hijacking, or other malicious activities within the context of the affected web application (CIS Advisory).

As of March 2024, there are no reports of this vulnerability being exploited in the wild (CIS Advisory).

Adobe has released security updates to address this vulnerability. Users are advised to update their Adobe Experience Manager installations to versions after 6.5.19.0. Organizations should apply the stable channel update provided by Adobe to vulnerable systems immediately after appropriate testing (Adobe Advisory).