Security readout for executives and security teams
Plain-English summary
A low-privileged user can place malicious script content in certain Adobe Experience Manager form fields. When another user opens the affected page, the script may run in that user’s browser, potentially exposing limited information or enabling unauthorized actions within the user’s session.
Executive priority
Schedule prompt remediation through normal vulnerability-management processes, prioritizing internet-facing or broadly accessible authoring environments. The issue is medium severity rather than an emergency because exploitation requires privileges and user interaction, with no cited active exploitation. Faster action is warranted where lower-trust users can submit content viewed by administrators or customers.
Technical view
CVE-2026-27247 is a CWE-79 cross-site scripting vulnerability with CVSS 3.1 score 5.4. Exploitation is network-accessible, low complexity, requires low privileges and victim interaction, and can cross security boundaries. The supplied description identifies AEM 6.5.23 and earlier; the record also identifies affected Cloud Service and 6.5 LTS release ranges.
Likely exposure
Exposure is most likely where affected AEM deployments permit low-privileged users to populate vulnerable form fields and other users subsequently view that content. Public reachability may increase opportunity, but authentication and victim interaction are still required. The bundle does not identify specific vulnerable components or field names.
Exploitation context
The source bundle does not report active exploitation, and the CVE is not listed as KEV. Abuse requires an authenticated low-privileged attacker to store crafted content and a victim to browse the affected page. Potential impact is limited confidentiality and integrity loss in the victim’s browser; availability impact is not indicated.
Researcher notes
The title characterizes this as DOM-based XSS, while the description describes stored injection into form fields; the bundle does not resolve that distinction. CVSS scope is changed, with low confidentiality and integrity impact. Specific fields, components, affected configurations, and technical root cause are not provided, so validation should remain controlled and vendor-guided.
Mitigation direction
- Inventory AEM versions and prioritize deployments allowing low-privileged content or form-field input.
- Apply the corrected Adobe release appropriate to the deployed AEM branch.
- Consult APSB26-24 for branch-specific upgrade requirements and any additional vendor guidance.
- Restrict untrusted users’ content-authoring permissions until remediation is verified.
- Review stored form content for unexpected scripts or suspicious markup.
Validation and detection
- Confirm each deployment’s exact AEM product branch and installed version.
- Verify AEM 6.5 deployments are upgraded beyond 6.5.23.
- Confirm Cloud Service and 6.5 LTS deployments meet Adobe’s corrected release level.
- Test authorized form inputs using harmless XSS detection strings in a non-production environment.
- Review browser-side security telemetry and AEM audit logs for suspicious stored content.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-27247 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N2.32.7adobeVulnerability scoring details
Base CVSS 3.1 score
5.4MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://helpx.adobe.com/security/products/experience-manager/apsb26-24.htmlCVE reference, adobe · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.