Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are vulnerable to a DOM‑based Cross‑Site Scripting flaw. An attacker can craft a URL or web page that manipulates the DOM environment of the victim’s browser, causing arbitrary JavaScript to execute under the victim’s browser context. The vulnerability is identified as CWE 79 and carries a CVSS score of 5.4, indicating moderate severity. Exploitation requires the victim to interact with a maliciously crafted page, and the change of scope suggests that the impact may extend beyond the immediate context of the page.

The affected product is Adobe Experience Manager from Adobe, specifically versions 6.5.24, LTS SP1, 2026.04 and all earlier releases.

The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, implying that no confirmed widespread exploitation has been observed yet. However, the required user interaction points to the risk of phishing or similar social engineering campaigns. The moderate CVSS score reflects the damage potential if malicious code runs in the victim’s browser, including data theft or credential compromise. Given the lack of available exploit data, the likelihood of successful attacks is uncertain but plausible, especially if users are not cautious about unknown links.