The vulnerability is a DOM-based cross‑site scripting flaw that allows an attacker to inject and execute arbitrary JavaScript within the victim’s browser context. An attacker can manipulate the DOM environment by directing a user to a crafted webpage, forcing the victim’s browser to run malicious code. The flaw changes the scope of the affected system, indicating that the vulnerability could impact broader components than originally intended.

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected. Any deployment of these revisions of Adobe’s digital asset and content management platform is at risk unless it has been updated beyond these releases.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is not available, but the vulnerability is not listed in CISA’s KEV catalog, suggesting it may not yet be widely exploited. Exploitation requires the victim to visit a maliciously crafted page, limiting the attack vector to a delivery via social engineering or compromised inbound traffic. Because the flaw changes scope, an attacker who succeeds could potentially gain a broader impact than isolated script execution.