CVE-2024-26085: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager (AEM) versions 6.5.20 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability. This security issue was assigned CVE-2024-26085 and was disclosed on June 13, 2024. The vulnerability affects both the standard AEM installations and AEM Cloud Service versions prior to 2024.5 (NVD CVE, Adobe Advisory).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue (CWE-79) that allows attackers to inject malicious scripts into vulnerable form fields. When victims browse to pages containing the compromised fields, the malicious JavaScript executes in their browsers. Adobe has assigned this vulnerability a CVSS v3.1 base score of 5.4 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD CVE).

If successfully exploited, this vulnerability could allow attackers to execute arbitrary JavaScript code in victims' browsers when they visit pages containing the compromised form fields. This could potentially lead to theft of sensitive information, session hijacking, or other client-side attacks (Adobe Advisory).

The vulnerability requires an attacker to have low-privileged access to the system and user interaction (visiting the compromised page) for successful exploitation. The attack can be performed remotely over the network (NVD CVE).

Adobe has released security updates to address this vulnerability. Users should upgrade to Adobe Experience Manager version 6.5.21 or later, or for AEM Cloud Service, update to version 2024.5 or later (NVD CVE).