Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier contain a stored Cross‑Site Scripting vulnerability that can be abused by a low‑privileged attacker to inject malicious JavaScript into vulnerable form fields. When a victim visits a page containing the injected code, the script may be executed in the victim’s browser. The CVE notes that the vulnerability’s scope has been changed, indicating a broader impact than initially described.

The affected product is Adobe Experience Manager. Versions impacted are 6.5.24, the LTS SP1 branch, and any release labeled 2026.04 or earlier. Vulnerable components include the form handling and content rendering engine that processes and stores form inputs.

The CVSS score of 5.4 indicates a moderate risk level. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Attackers could exploit the flaw from a web interface by submitting malicious payloads into form fields that the system does not properly neutralize. Because the flaw is stored, the injected code remains in the system and will execute for all users who view the affected page. The required access level is low‑privileged, meaning any user capable of entering data into the vulnerable forms could potentially deliver the attack payload.