Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross‑Site Scripting (XSS) vulnerability. A low‑privileged attacker may inject malicious JavaScript into vulnerable form fields. When a victim browses a page containing the injected content, the script runs in the victim's browser, enabling credential theft, session hijacking, or the delivery of further malware. The vulnerability changes the scope but does not allow direct server‑side code execution.

Adobe Experience Manager, specifically versions 6.5.24, LTS SP1, 2026.04 and all earlier releases. Users of these editions running the affected versions are at risk until a patch is applied.

The CVSS score of 5.4 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely through a web interface that accepts user‑generated content in form fields; a low‑privileged user with write access to such fields can complete the exploit. Successful exploitation requires the victim to load the page, so social engineering or phishing may increase attack success. Overall risk is moderate, with potential impact on confidentiality and integrity of user data.