Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier contain a DOM‑based cross‑site scripting flaw that permits an attacker to inject and execute arbitrary JavaScript within the victim’s browser environment. The vulnerability is triggered when a user visits a specially crafted page and relies on manipulation of the DOM; it could enable theft of session data, credentials, or other sensitive information controlled by the site.

The affected product is Adobe Experience Manager from Adobe. Vulnerable releases include version 6.5.24, the LTS SP1 line, and the 2026.04 release and any earlier builds.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction with a crafted webpage, making it a typical web‑based attack. Once executed, the malicious script runs in the victim’s browser context, potentially compromising confidentiality or integrity of the session. The scope is changed, which broadens the impact beyond the original component. Overall, the risk is moderate but mitigatable through patching and protective controls.