CVE-2024-26089: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability, identified as CVE-2024-26089. The vulnerability was discovered and disclosed on February 14, 2024, by Adobe Systems Incorporated (MITRE CVE).

This vulnerability is classified as a DOM-based Cross-Site Scripting (XSS) issue (CWE-79). The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, indicating network accessibility with low attack complexity, no privileges required, and user interaction needed (NVD).

The vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. This could potentially lead to unauthorized access to sensitive information and manipulation of web content within the user's browser session (MITRE CVE).

Exploitation of this vulnerability requires user interaction, specifically requiring the victim to visit a web page containing maliciously crafted script. The attack vector is network-accessible, making it possible to exploit remotely (NVD).

Adobe has addressed this vulnerability in versions after 6.5.20. Users are advised to update their Adobe Experience Manager installations to the latest version to mitigate this security risk (Adobe Advisory).