DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment via a crafted URL or webpage. All three AEM delivery models are affected - on-premises 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has published Security Bulletin APSB26-98 addressing this issue; no public exploit code and no CISA KEV listing have been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to execute arbitrary JavaScript within a victim's browser by enticing them to visit a crafted URL. All currently supported AEM deployment models are affected - Cloud Service through 2026.7.0, on-premises 6.5 through 6.5.24, and 6.5 LTS through SP2. The scope change in the CVSS vector indicates the JavaScript executes in a context beyond the vulnerable component itself, potentially enabling session hijacking or privilege escalation within the AEM environment. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
DOM-based XSS in Adobe Experience Manager enables an authenticated attacker to inject malicious JavaScript that executes within a victim's browser by manipulating client-side DOM sinks on crafted or attacker-influenced AEM pages. Affected deployments span AEM 6.5 on-premises through version 6.5.24, the 6.5 LTS track through SP2, and AEM as a Cloud Service through the 2026.7.0 release channel. Adobe has addressed the issue in advisory APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a network-adjacent, low-privileged attacker to execute arbitrary JavaScript within a victim's browser session by luring them to a crafted webpage. The vulnerability arises from unsanitized attacker-controlled data being written into the DOM without server-side involvement, enabling script execution in a changed security scope (S:C). Exploitation requires user interaction and no public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) enables an authenticated attacker to execute arbitrary JavaScript in a victim's browser by manipulating client-side DOM sources and sinks via a crafted webpage. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 (≤6.5.24), and AEM 6.5 LTS (≤SP2), as confirmed by Adobe APSB26-98. The CVSS scope-change metric (S:C) indicates the payload escapes the AEM application context and can affect the victim's broader browser environment; no public exploit identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated, low-privileged attacker to execute arbitrary JavaScript in a victim's browser session by inducing that authenticated user to visit a crafted webpage. Affected versions span AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. The CVSS scope-change indicator (S:C) reflects that injected scripts execute within the victim's browser context, potentially enabling session theft, credential harvesting, or actions performed on behalf of the victim beyond the AEM application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to execute arbitrary JavaScript in a victim's browser by luring the victim to a crafted webpage. Affected are AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope-changed impact means the malicious script executes outside the originating application boundary, enabling session hijacking, credential theft, or UI redressing against authenticated AEM users. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary JavaScript within a victim's browser session by delivering a crafted URL that manipulates the client-side DOM environment. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The CVSS scope change (S:C) indicates the injected script executes in a different browser security context than the attacker's origin, enabling cross-context session abuse. No public exploit or CISA KEV listing is present at time of analysis.
DOM-based XSS in Adobe Experience Manager allows authenticated low-privileged attackers to inject malicious JavaScript into a victim's browser by luring them to a specially crafted URL that manipulates the client-side DOM without server-side involvement. Affected versions include AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has issued a fix under advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to inject and execute arbitrary JavaScript within a victim's browser by enticing them to visit a crafted URL or page, with scope change enabling cross-context impact. Affected versions include AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0, all addressed under Adobe Security Bulletin APSB26-98. No public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to inject malicious JavaScript into a victim's browser by manipulating the DOM environment through a crafted webpage. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit has been identified at time of analysis; Adobe has published security bulletin APSB26-98 addressing this issue.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to execute arbitrary JavaScript in a victim's browser by delivering a specially crafted URL or page that exploits client-side DOM processing. Affected are AEM 6.5 LTS through SP2, AEM 6.5 on-premise through 6.5.24, and AEM as a Cloud Service through the 2026.7.0 release. Successful exploitation enables session hijacking, credential theft, or unauthorized actions performed within the AEM environment on behalf of the victim, with scope change indicating impact crosses from the web application into the victim's browser context.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted webpage that manipulates the client-side DOM environment. The scope-changed CVSS vector (S:C) confirms the malicious script executes in the victim's browser security context rather than the server, enabling session hijacking, credential theft, or UI redress against AEM users. Reported directly by Adobe PSIRT and addressed in advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to manipulate client-side DOM variables to inject and execute arbitrary JavaScript within a victim's browser session. Affected are AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, per Adobe advisory APSB26-98. The scope change in the CVSS vector indicates that injected scripts can reach browser resources outside the AEM application origin, enabling session hijacking or cross-application data theft when a victim clicks a crafted link.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a network-accessible, low-privileged attacker to inject malicious JavaScript that executes entirely within a victim's browser session by manipulating the DOM environment. Affected versions span the AEM 6.5 branch (≤6.5.24), the 6.5 LTS edition (≤SP2), and AEM as a Cloud Service (≤2026.7.0), covering a broad enterprise install base. The CVSS vector confirms a scope change (S:C), meaning successful exploitation can affect browser resources beyond the originating AEM page - such as session tokens or cross-frame content - though user interaction via a crafted webpage visit is required for the attack to succeed.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) enables authenticated attackers with low-level access to inject malicious JavaScript into victim browsers, achieving a scope change that allows cross-origin script execution. Affected versions span AEM as a Cloud Service ≤2026.7.0, AEM 6.5 LTS ≤SP2, and AEM 6.5 ≤6.5.24, as confirmed by Adobe advisory APSB26-98. Exploitation requires user interaction; no public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject malicious JavaScript that executes inside a victim's browser when the victim visits a specially crafted URL or page hosted within the AEM environment. Affects AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. No public exploit identified at time of analysis; Adobe has released patches via advisory APSB26-98.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by directing the victim to a crafted webpage that manipulates the AEM client-side DOM environment. Affected releases span AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. The scope-changed impact means the injected script operates outside AEM's own origin boundary, enabling session theft or unauthorized actions against the authenticated victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) allows a low-privileged attacker to execute arbitrary JavaScript within a victim's browser by luring them to a crafted webpage that manipulates the client-side DOM environment. Affected versions span AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. The vulnerability carries a scope-change flag (S:C), indicating the injected script can affect browser context beyond AEM's own page, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by manipulating the DOM environment through a crafted webpage. Affected are AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit or KEV listing has been identified at time of analysis; exploitation requires both attacker authentication (PR:L) and victim interaction with a crafted URL or page.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript within a victim's browser by enticing them to visit a specially crafted URL. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the July 2026 (2026.7.0) release, with Adobe addressing this in security bulletin APSB26-98. The CVSS scope-change metric (S:C) reflects that successful exploitation crosses the AEM application boundary into the victim's browser context, enabling session hijacking, credential theft, or forced authenticated actions - no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject and execute arbitrary JavaScript in victims' browsers after social-engineering them into visiting a crafted webpage. Affected versions span AEM as a Cloud Service up to 2026.7.0, AEM 6.5 up to 6.5.24, and AEM 6.5 LTS up to SP2. The CVSS scope-change indicator (S:C) means injected scripts can reach browser contexts beyond the AEM origin, elevating potential impact to cross-origin session theft or privilege escalation within the CMS authoring environment. No public exploit or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2 enables authenticated low-privileged attackers to inject and execute arbitrary JavaScript in a victim's browser by manipulating the Document Object Model client-side. The scope change (S:C in the CVSS vector) confirms that successful exploitation escapes AEM's own security boundary, allowing the injected script to access browser-resident resources such as cookies, localStorage, or cross-origin-accessible DOM of other open pages. Exploitation requires a victim with a valid AEM session to be social-engineered into visiting a crafted URL, making this a realistic privilege-escalation vector from author/editor to administrator in enterprise AEM deployments. No public exploit code or CISA KEV listing identified at time of analysis; vendor advisory APSB26-98 is available.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated remote attackers to execute arbitrary JavaScript in a victim's browser by manipulating the DOM environment of a crafted webpage the victim is induced to visit. Affected deployments span AEM 6.5 on-premises through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has released a remediation via advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute arbitrary JavaScript within a victim's browser session by manipulating the client-side DOM environment. Affected versions span the AEM 6.5 branch (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). Exploitation requires the attacker to hold a low-privileged AEM account and socially engineer a target user into visiting a crafted URL; no public exploit or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within a victim's browser by manipulating the client-side DOM environment, achieving a scope change that can affect resources beyond the AEM origin. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), covering both cloud and on-premises enterprise installations. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires a victim to interact with a crafted webpage delivered by the attacker.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript in a victim's browser by inducing them to visit a crafted URL that manipulates client-side DOM sinks. Affected deployments span AEM 6.5 on-premises through version 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The CVSS scope-change (S:C) indicates injected scripts execute outside the vulnerable component's security boundary, enabling session theft or privileged action execution within the AEM browser origin. No public exploit or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript in a victim's browser session by luring the victim to a crafted URL or webpage. Affected deployments span Adobe Experience Manager 6.5 (through 6.5.24), Experience Manager 6.5 LTS (through SP2), and the Experience Manager as a Cloud Service (through the 2026.7.0 release). The scope-change designation confirms the malicious script executes outside the AEM server context - in the victim's browser - enabling session token theft, credential harvesting, or unauthorized AEM actions on behalf of the victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) enables a low-privileged authenticated attacker to inject malicious JavaScript into a victim's browser by manipulating client-side DOM sources before they reach execution sinks. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release; Adobe has addressed this through security advisory APSB26-98. The CVSS scope-change flag (S:C) reflects that successful exploitation crosses the boundary from the vulnerable AEM application into the victim's browser context, enabling session hijacking or unauthorized content manipulation on behalf of higher-privileged users.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated, low-privileged attacker to inject and execute malicious JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM sources. Affected deployments span AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 through 6.5.24. The CVSS scope-change designation (S:C) indicates injected script can reach browser context beyond the AEM application boundary; no public exploit has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by directing them to a crafted URL, with scope change enabling cross-context impact beyond the AEM application itself. Affected deployments span AEM 6.5 LTS up to SP2, AEM 6.5 up to version 6.5.24, and AEM as a Cloud Service up to the 2026.7.0 release. No public exploit code or active exploitation has been confirmed at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to inject and execute malicious JavaScript in a victim's browser by luring them to a crafted webpage that manipulates the client-side DOM environment. Affected are AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), per Adobe advisory APSB26-98. The scope-change designation (S:C) indicates injected scripts can reach browser resources beyond AEM's own application boundary, enabling session theft or cross-origin actions. No public exploit or CISA KEV listing is present at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM processing. Affected versions include AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. Exploitation requires user interaction (victim must visit the crafted page), and the scope change in the CVSS vector (S:C) confirms the attack can affect resources beyond the immediate AEM application context. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript within a victim's browser session after tricking that user into visiting a crafted page. The vulnerability spans AEM as a Cloud Service (≤2026.7.0), AEM 6.5 on-premises (≤6.5.24), and AEM 6.5 LTS (≤SP2), covering all major supported deployment tracks. Adobe has released remediation via Security Bulletin APSB26-98; no confirmed active exploitation or public exploit code is recorded at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager enables a low-privileged attacker to inject and execute arbitrary JavaScript within a victim's browser session by manipulating the DOM environment through a crafted webpage. The vulnerability affects AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, with scope change indicating the malicious script can reach beyond AEM's own security context into the victim's broader browser environment. Adobe has addressed this in advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject malicious JavaScript that executes within a victim's browser session by manipulating the DOM environment client-side. Affecting AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, exploitation requires the victim to visit a specially crafted webpage, making social engineering a necessary step. Adobe has released APSB26-98 addressing all three product lines; no public exploit or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privileged attackers to execute arbitrary JavaScript within a victim's browser by inducing them to visit a specially crafted AEM webpage, with the scope crossing the AEM origin boundary into the browser's security context. All three supported deployment tracks are affected: AEM as a Cloud Service through the 2026.7.0 release cycle, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. Adobe addressed this under advisory APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL or page that manipulates the client-side DOM. Affected deployments span AEM 6.5 on-premises (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0), covering a broad range of enterprise CMS installations. The scope-changed CVSS vector (S:C) signals that the script executes beyond the AEM application context - enabling session hijacking, credential theft, or action-on-behalf-of attacks targeting higher-privilege users. No public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to deliver a crafted URL that, when visited by an authenticated victim, executes arbitrary JavaScript within the victim's browser context with scope change across security boundaries. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. Adobe has released APSB26-98 addressing this issue; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript that executes entirely within a victim's browser, bypassing server-side defenses. Affected products span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The scope-changed classification (S:C) indicates the injected script can operate beyond the AEM application boundary in the victim's browser context, enabling session hijacking or credential theft from a higher-privileged user. No confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript that executes within a victim's browser session by luring them to a crafted webpage. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, with scope changed - meaning injected scripts can affect resources beyond the immediate AEM origin. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor advisory APSB26-98 covers remediation.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged remote attacker to execute malicious JavaScript in a victim's browser by luring the victim to a crafted URL or page that manipulates the client-side DOM environment. Affected versions span the entire AEM 6.5 line through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. Adobe has addressed this through APSB26-98; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment via a crafted webpage. Affected deployments span AEM 6.5 on-premises (≤6.5.24), AEM 6.5 LTS (≤SP2), and AEM as a Cloud Service (≤2026.7.0), as documented in Adobe APSB26-98. The CVSS S:C scope-change designation confirms the payload can escape the vulnerable component's security boundary, enabling session hijacking or cross-origin data exfiltration against privileged AEM users. No public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) allows an authenticated attacker to inject malicious JavaScript into a victim's browser by manipulating the DOM environment through a crafted webpage. The vulnerability affects AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, and carries a scope change meaning injected scripts execute beyond the attacker's origin context. No public exploit identified at time of analysis, and it is not listed in the CISA KEV catalog.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within a victim's browser by luring them to a crafted webpage. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and the Cloud Service through the 2026.7.0 release. Scope is changed per the CVSS vector, meaning the exploit crosses the boundary from the AEM application context into the broader browser environment; no public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privilege authenticated attackers to execute arbitrary JavaScript in victims' browsers by delivering crafted URLs or pages that manipulate the client-side DOM environment. All supported AEM deployment modes are affected: on-premises 6.5.x through 6.5.24, 6.5 LTS through SP2, and Cloud Service through 2026.7.0. Adobe addressed this in security bulletin APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted webpage. The vulnerability spans Adobe Experience Manager as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), per APSB26-98. No active exploitation or public exploit code has been identified at time of analysis, though the scope-changed nature means successful exploitation can cross security boundaries within the victim's browser context.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated, low-privileged attacker to inject and execute arbitrary JavaScript in the browser session of any victim who visits a crafted AEM page. Affected are AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 on-premise through 6.5.24. The scope-changed CVSS rating (S:C) reflects that the injected script executes in the victim's browser context and can reach resources-such as session tokens and authenticated API calls-beyond the originating AEM page, amplifying the practical impact relative to the medium base score.
DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute malicious JavaScript within a victim's browser by delivering a crafted URL or page that manipulates the client-side DOM. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope change in the CVSS vector reflects that injected script executes beyond the originating component boundary, potentially enabling session theft or privilege escalation against higher-privileged AEM users. No public exploit or CISA KEV listing has been identified at time of analysis.
DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) allows an authenticated attacker to execute arbitrary JavaScript within a victim's browser by enticing them to visit a crafted URL, affecting AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the July 2026 release. The CVSS scope change (S:C) signals that the injected script escapes AEM's own browser origin boundary, enabling session hijacking or unauthorized CMS operations under the victim's identity. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the broad enterprise footprint of AEM makes patching a priority.