Adobe Experience Manager is affected by a DOM‑based XSS vulnerability that allows an attacker to inject malicious JavaScript by manipulating the DOM environment. The flaw requires that the victim visit a crafted webpage, after which the browser executes the injected script using the victim’s privileges. This can lead to theft of session cookies, defacement, or execution of arbitrary actions within the user’s session.

Adobe Experience Manager versions 6.5.24, FP11.7 and all earlier releases are vulnerable. The issue has been identified in the AEM product family and affects all deployments that have not applied the latest security patch.

The CVSS score is 5.4, indicating moderate severity, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction, meaning an attacker must entice the victim to open a specially crafted page, which limits the attack surface. Given the moderate score and interaction requirement, the overall risk is moderate but should be mitigated promptly, especially in environments with public exposure.