Adobe Experience Manager is vulnerable to an improper redirect that allows an attacker to craft a malicious URL which will redirect a user’s browser to a site controlled by the attacker. If a victim follows the link, they could be directed to a phishing page that may steal credentials, leading to an account takeover. The weakness is a classic Open Redirect (CWE‑601).

The vulnerability affects Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and all earlier releases. Users running any of these versions are at risk until the software is upgraded.

The CVSS score of 4.3 indicates moderate severity and the missing EPSS score shows no publicly known exploitation data. The vulnerability is not listed in CISA KEV, suggesting it has not yet been actively exploited. The attack requires user interaction—an individual must click a malicious link. Consequently, the risk is primarily to users who encounter such links, especially those with administrative or privileged accounts.