Adobe Experience Manager is vulnerable to a reflected Cross‑Site Scripting flaw that allows an attacker to inject malicious scripts into web pages. If successfully exploited, the attacker could execute code in the victim’s browser, potentially gaining elevated access or control of the victim’s account or session. The vulnerability is classified as a scope‑changing flaw, meaning that compromise could affect additional components beyond the initial scope of the input.

The flaw affects Adobe Experience Manager products including version 6.5, the 6.5 LTS release, and the experience manager as a cloud service. No other vendors or product lines are currently listed as affected.

The CVSS score of 9.3 indicates a high severity, and the attack requires only user interaction with a malicious URL or injected content; based on the description, it is inferred that the attacker can be external. EPSS is not available, but the absence of a KEV listing does not reduce the urgency of mitigation. Attackers can obtain elevated privileges by leveraging the reflected script payload, so the risk of exposure and potential data loss is significant.