A DOM‑based cross‑site scripting vulnerability in Adobe Experience Manager allows an attacker who lures a user to a crafted web page to inject and execute malicious JavaScript in the victim’s browser. The flaw stems from inadequate sanitization of client‑side input and is classified as CWE‑79. Because the vulnerability’s scope is altered, it can affect parts of the application beyond the initially targeted component, increasing the potential impact on the target system.

Adobe Experience Manager, versions 6.5.24, LTS SP1, 2026.04 and any earlier releases.

The CVSS score is 5.4, indicating moderate severity. No EPSS score is published, so the observed exploitation probability is unknown. Adobe does not list it in the CISA KEV catalog. Exploitation requires user interaction—specifically, a victim must open a maliciously crafted page—so it is mitigated by user awareness and defensive controls. The changed scope raises the risk of broader impact if the attacker successfully manipulates the DOM.