The vulnerability is a reflected Cross‑Site Scripting flaw that allows an attacker to inject malicious scripts into a web page. This flaw can lead to elevated access or control over a victim’s account or session, and the stated scope change indicates that the impact may extend beyond the originally affected context. The weakness is classified as CWE‑79.

Adobe Experience Manager Forms JEE, specifically LTS SP1 and any release 6.5.24.0 or earlier, is vulnerable to the reflected XSS described above.

The CVSS score of 8 marks the vulnerability as high severity, and it is not listed in the CISA KEV catalog. The EPSS score is not available, but the stated requirement for user interaction – a victim must visit a maliciously crafted URL or otherwise engage with a compromised page – means that the likelihood of widespread exploitation remains moderate. The vulnerability’s scope change suggests that exploitation could potentially lead to broader compromise within the application once an attacker gains initial access.