Adobe Experience Manager is vulnerable to a DOM‑based XSS flaw that enables an attacker to inject and execute malicious JavaScript within the victim’s browser. The vulnerability arises from improper handling of user‑controlled data that is reflected into the DOM environment, allowing an attacker to run code in the context of the affected application. The impact is the compromise of client‑side confidentiality and potential session hijacking or phishing attacks triggered when the targeted user visits a crafted page.

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and any earlier releases are affected. These versions are listed as vulnerable in the official Adobe advisory and span the LTS and regular release branches of AEM.

The CVSS score of 5.4 places this issue in the medium severity range, but the risk is increased by the scope change, indicating that the flaw might affect other components within the application. The EPSS score is currently unavailable, though the vulnerability is not included in CISA’s KEV catalog. Exploitation requires user interaction – a victim must navigate to a malicious webpage crafted by an attacker. Once the page loads, the DOM trickery can run arbitrary JavaScript, leading to potential data theft or impersonation within the user's session.