Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are vulnerable to a DOM‑based Cross‑Site Scripting (XSS) flaw (CWE‑79). The flaw allows an attacker to manipulate the Document Object Model in a victim’s browser and execute arbitrary JavaScript. Because the attacker needs only a crafted web page to be visited, the attack requires user interaction and cannot be triggered remotely from the server. Successful exploitation could let the attacker run malware, harvest credentials, or deface the site within the victim’s session context.

Adobe Experience Manager administrative consoles and content authoring sites running on the affected releases are impacted. This includes the 6.5.24 LTS SP1 release, the 2026.04 patch set, and any earlier builds of that line. Systems that have remained on or before these versions, without applying the vendor’s published fix, must evaluate their exposure.

The vulnerability carries a CVSS score of 5.4, indicating moderate severity. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog. Although the flaw is not immediately exploitable from the server side, the requirement for user interaction means that phishing or social engineering could be employed to trick users into visiting malicious URLs. The scope change indicates that exploitation could potentially affect all components loaded in the user’s browser session.