Adobe Experience Manager is vulnerable to a DOM‑based XSS flaw that enables an attacker to inject and run malicious JavaScript in a victim’s browser. The flaw requires the victim to visit a specially crafted web page and is classified as a change in scope, meaning the attacker can achieve execution only within the context of the victim’s session without elevating privileges. Affected systems include Adobe Experience Manager 6.5, 6.5 LTS and Adobe Experience Manager as a Cloud Service, all of which are mentioned by Adobe as impacted by the vulnerability. No specific versions are listed beyond the product family. The CVSS score of 5.4 signals a moderate severity, and the absence of an EPSS score means the exploitation probability is unknown. The vulnerability is not listed in CISA’s KEV catalog, further indicating that widespread exploitation has not been observed. Because exploitation requires user interaction, the risk is limited to scenarios where a user opens a malicious page.

Affected systems encompass Adobe Experience Manager 6.5, Adobe Experience Manager 6.5 LTS, and Adobe Experience Manager as a Cloud Service. These product lines were identified by Adobe as impacted by the DOM‑based XSS vulnerability; however, the advisory does not enumerate specific build or patch versions, so all current installations within these releases are presumed vulnerable until a patch is applied.

The assigned CVSS score of 5.4 places the flaw in the moderate severity category, indicating that successful exploitation could allow an attacker to inject and execute client‑side scripts but not to gain higher privileges. The EPSS score is not provided, leaving the exploitation probability uncertain; the advisory also notes that the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has yet been reported. Attackers need to entice a user to visit a malicious page, making the threat largely confined to social engineering scenarios or compromised content.