Adobe Experience Manager is vulnerable to a stored XSS flaw that allows an attacker to inject malicious JavaScript into form fields that are then rendered to any user visiting the affected page. The injected script executes in the victim’s browser, giving the attacker the ability to elevate their own privileges or take over the victim’s session, potentially allowing full exploitation of the account or the system. The weakness is a classic input‑validation failure and is classified as CWE‑79.

The vulnerability applies to Adobe Experience Manager version 6.5 and its 6.5 LTS release. No other versions are known to be affected by this specific stored XSS flaw according to the available CNA data.

With a CVSS score of 9.3, the severity is high and the scope can be altered. The EPSS score is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The typical attack path requires the attacker first to discover or guess a writable form field, inject the payload, and then lure a victim to the crafted page. Once the victim’s browser processes the malicious script, the attacker can hijack the session or elevate access. Because the flaw is stored, it makes the exposure persistent for all users who view the vulnerable content.