Adobe Experience Manager is vulnerable to a stored Cross‑Site Scripting flaw (CWE‑79) that enables a low‑privileged attacker to embed malicious JavaScript into form fields. When a victim views a page containing the compromised field, the injected script runs in the victim’s browser, potentially compromising the user’s session, data, or executing other malicious actions.

Affected editions include Adobe Experience Manager versions 6.5.24, the LTS SP1 release, and the 2026.04 release, as well as any earlier builds of those series.

The CVSS base score is 5.4, indicating moderate severity, and the EPSS score is not yet available. The vulnerability is not currently listed in the CISA KEV catalog. Attackers are expected to exploit the flaw by supplying malicious input to a vulnerable form field that is later stored and displayed within the site, allowing the embedded script to run in the browsers of any user who visits the affected page. The scope change indicates the flaw can affect a wider segment of the application, increasing potential exposure.