CVE-2024-26075: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2024-26075 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager versions 6.5.20 and earlier. The vulnerability was discovered and disclosed in June 2024, with Adobe Systems Incorporated serving as the assigning CNA (NVD, CVE).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue that allows attackers to inject malicious scripts into vulnerable form fields. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility with low attack complexity, requiring low privileges and user interaction (NVD).

When exploited, the vulnerability allows malicious JavaScript to be executed in a victim's browser when they browse to a page containing the vulnerable field. This could potentially lead to unauthorized access to user data and compromise of user sessions (NVD).

The vulnerability requires low attack complexity and low privileges to exploit, though it does require user interaction. The attacker needs to have access to inject malicious scripts into form fields, which would then be stored and executed when other users access the affected pages (NVD).

Adobe has addressed this vulnerability in versions after 6.5.20. Organizations are advised to upgrade their Adobe Experience Manager installations to the latest version to mitigate this security risk (Adobe Advisory).