CVE-2024-26077: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-26077. This security flaw was disclosed on June 13, 2024, and affects both on-premises installations and AEM Cloud Service versions up to 2024.5 (NVD, Adobe Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability allows attackers to inject malicious scripts into vulnerable form fields (NVD).

When exploited, this vulnerability allows malicious JavaScript to be executed in a victim's browser when they browse to the page containing the vulnerable field. The impact is considered medium severity, with potential for limited confidentiality and integrity breaches (Adobe Advisory).

The vulnerability requires network access and low privilege levels for exploitation, though user interaction is required as the victim needs to browse to the affected page. The attack complexity is considered low, making it relatively straightforward to exploit once the necessary conditions are met (NVD).

Adobe has addressed this vulnerability in Experience Manager version 6.5.21 and AEM Cloud Service version 2024.5. Users are advised to update to these or later versions to mitigate the risk (Adobe Advisory).