Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier contain a stored Cross‑Site Scripting flaw that can be leveraged by a low‑privileged user to inject malicious JavaScript into form fields; when a victim visits the page containing the field the script executes in the victim’s browser. The vulnerability permits modification of the page’s content. The weakness is a classic input validation error (CWE‑79).

The affected systems are Adobe Experience Manager deployments running versions 6.5.24, LTS SP1, 2026.04 or earlier, provided by Adobe Corporation.

The CVSS score of 5.4 classifies this issue as medium severity, and the EPSS score is not available. It is not listed in the CISA KEV catalog. The likely attack vector arises when an attacker submits data to a vulnerable form field, and the stored input is later rendered to users. Because the flaw can be abused by a low‑privileged attacker, the risk is contingent on the attacker's ability to reach the form and the extent to which the content is displayed to other users. The scope is changed, meaning the vulnerability can affect the entire application context once injected data is rendered.