Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier contain a DOM-based Cross‑Site Scripting flaw that allows an attacker to manipulate the Document Object Model and execute malicious JavaScript in the victim’s browser context. The vulnerability requires the victim to visit a specially crafted webpage; once loaded, the injected script runs with the same privileges as the user, potentially enabling session hijacking, data theft, or defacement.

Vendors affected are Adobe, specifically Adobe Experience Manager. All instances of the product running the listed versions or earlier are vulnerable, including 6.5.24, LTS SP1, 2026.04, and all earlier releases.

The CVSS score of 5.4 reflects moderate severity, and the lack of an EPSS score suggests no known large‑scale exploitation yet. The flaw is not listed in CISA’s KEV catalog, further indicating limited public exploitation. The attack vector relies on user interaction; a user must click a crafted link or open a malicious page. As the vulnerability can alter the behaviour of the victim’s browser, it poses a risk to confidentiality and integrity of data within the session, and it could also allow resource consumption or denial of service if the malicious script is designed to hang the browser.