This vulnerability is a DOM‑based cross‑site scripting flaw found in Adobe Experience Manager. An attacker can manipulate the DOM environment to inject malicious JavaScript that executes within the context of a victim’s browser when the user visits a specially crafted page. The flaw requires user interaction, so exploitation depends on social engineering tactics such as phishing.

The flaw impacts Adobe Experience Manager releases 6.5.24, LTS SP1, 2026.04 and earlier. Any system running these versions is vulnerable until an update that removes the flaw is applied.

With a CVSS score of 5.4 the vulnerability is of moderate severity. The EPSS score is not provided and it is not listed in CISA’s KEV catalog, indicating that known attacks have not yet been reported. Nevertheless, because the exploit requires a crafted webpage that the user must open, the attack vector is external and can be achieved over HTTP or HTTPS. The changed scope means that the flaw can affect areas beyond the originating user session, potentially compromising the application’s content or configuration.