An attacker can exploit a DOM‑based Cross‑Site Scripting vulnerability in Adobe Experience Manager by manipulating the DOM environment to run malicious JavaScript in the victim's browser. The flaw requires the victim to visit a crafted webpage, after which the attacker can inject or execute arbitrary client‑side script. This may lead to defacement, cookie theft, or phishing. The flaw is identified as CWE‑79.

Adobe Experience Manager 6.5, including the 6.5 LTS release, and the Adobe Experience Manager as a Cloud Service edition are potentially affected. No specific version ranges are provided, which means all publicly released versions of these products could be vulnerable.

The vulnerability carries a CVSS score of 5.4, indicating moderate severity. Because the EPSS score is not available, the actual exploitation probability is unclear, and the issue is not listed in the CISA KEV catalog. The attack vector is user‑interaction via a crafted webpage, so it is not remotely exploitable without the victim’s engagement. Organizations should assess whether their users are likely to encounter such crafted pages and consider the potential impact.