Adobe Experience Manager versions 6.5.23 and earlier contain a stored Cross‑Site Scripting (XSS) vulnerability. An attacker can place malicious JavaScript code into vulnerable form fields that are saved to the database. When a legitimate user views a page containing that field, the injected script is executed in the user’s browser, potentially enabling session hijacking, data theft, or other client‑side attacks. The weakness is identified as CWE‑79, a classic input validation failure that allows code injection.

Affected products include Adobe Experience Manager and AEM Cloud Service. Specifically, any installation of AEM 6.5.23 or earlier is vulnerable. The CPE list cites cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:* and related cloud service entries. All impacted versions are those published before the patch that fixed the stored XSS issue.

The CVSS score of 5.4 denotes a moderate severity. EPSS indicates the probability of exploitation is low (<1 %). The vulnerability is not listed in the CISA KEV catalog. Attackers are likely to exploit the flaw by submitting malicious payloads through any accessible form field that is then rendered on a page viewable by other users. The attack vector is inferred from the stored XSS description, and no additional authentication is required to inject the payload.