CVE-2024-26096: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-26096. The vulnerability was discovered and disclosed on March 18, 2024, and affects Adobe Experience Manager's form field functionality (NVD, CVE).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) vulnerability with a CVSS v3.1 base score of 5.4 (Medium). The attack vector is characterized as network-accessible (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and user interaction (UI:R). The scope is changed (S:C) with low confidentiality (C:L) and integrity (I:L) impacts, and no availability impact (A:N) (Adobe Security).

If exploited, this vulnerability allows attackers to inject malicious scripts into vulnerable form fields. When victims browse to the page containing the vulnerable field, malicious JavaScript may be executed within the context of their browser, potentially leading to unauthorized data access or manipulation (CIS Advisory).

The vulnerability requires low privileges and user interaction for successful exploitation. Currently, there are no reports of this vulnerability being exploited in the wild (CIS Advisory).

Adobe has released security updates to address this vulnerability. Organizations are advised to update to the latest version of Adobe Experience Manager. The vulnerability affects versions 6.5.19 and earlier, and users should upgrade to version 6.5.20.0 or later (Adobe Security).