Adobe Experience Manager is vulnerable to a DOM‑based Cross‑Site Scripting flaw that allows an attacker to manipulate the Document Object Model and execute malicious JavaScript in the victim’s browser. The attack requires a user to visit a specially crafted page and can lead to execution of arbitrary code within the victim’s session, potentially compromising credentials or data that the user has access to. The vulnerability’s scope has been changed, indicating that the effect could extend beyond the initial user context.

Adobe Experience Manager 6.5.24, LTS SP1, 2026.04 and all earlier releases are affected. Users of these versions should verify their build and immediately consult Adobe’s advisory linked in the references.

The CVSS score of 5.4 denotes a medium risk level, and the exploit probability is not reported. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Because the flaw requires user interaction to reach a crafted URL, the likelihood of accidental exploitation is moderate, but an attacker with social engineering or phishing capabilities could readily trigger it. Mitigation should focus on applying the vendor patch and reducing browser exposure to untrusted content.