Adobe Experience Manager is vulnerable to a DOM‑based Cross‑Site Scripting flaw that allows an attacker to execute arbitrary JavaScript within a victim’s browser context. The vulnerability is achieved by manipulating the browser’s DOM environment with a crafted webpage. The impact is limited to the security context of the victim’s user session; it does not alter system configuration or grant privileged access. The flaw is classified as CWE‑79.

Adobe Experience Manager versions 6.5 and the 6.5 LTS branch are affected, as identified by the CNA. No other Adobe products are listed as impacted by this issue.

The CVSS score of 5.4 indicates a moderate risk level. Exploitation is contingent upon user interaction—specifically, the victim must open a maliciously constructed webpage—so widespread autonomous attack is unlikely. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting that no confirmed active exploitation has been reported.