CVE-2024-26107: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability that was discovered and disclosed in March 2024. The vulnerability, tracked as CVE-2024-26107, affects Adobe Experience Manager's content and asset management suite (NVD, Adobe Advisory).

The vulnerability is classified as a reflected Cross-Site Scripting (XSS) issue with a CVSS v3.1 base score of 5.4 (Medium), and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is identified under CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

If successfully exploited, an attacker could execute malicious JavaScript content within the context of the victim's browser when the victim visits a URL referencing a vulnerable page (CIS Advisory).

The vulnerability requires an attacker to convince a victim to visit a specially crafted URL that references a vulnerable page. Currently, there are no reports of this vulnerability being exploited in the wild (CIS Advisory).

Adobe has released version 6.5.20.0 to address this vulnerability. Organizations are advised to update their Adobe Experience Manager installations to the latest version immediately after appropriate testing (Adobe Advisory).