Adobe Experience Manager CVE-2026-106628

Exploitation requires a low-privileged authenticated context (CVSS PR:L) AND active victim interaction: a victim must be lured into visiting an attacker-crafted webpage that manipulates the DOM environment, per the description. These two factors - required authentication/privilege level and mandatory user interaction (UI:R) - are the primary limiters, meaning the attack cannot be automated or executed unattended against default configurations and depends on social engineering of an authenticated user. Affected deployments are Adobe Experience Manager 6.5 LTS (through SP3) and AEM 6.5 (through 6.5.25); environments on patched releases are not exploitable. No special non-default feature toggle is named in the description beyond the DOM-manipulation vector inherent to the affected AEM components.

This is a moderate, not high-priority, issue. The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) reflects a DOM-based XSS that requires both authentication (PR:L) and victim interaction (UI:R), with only low confidentiality and integrity impact and no availability impact - the scope change (S:C) accounts for script executing in the victim's browser context outside the vulnerable component. All exploitation signals point the same way and are consistent: CISA's SSVC decision framework rates Exploitation as 'none' (no observed exploitation), Automatable as 'no' (the required user interaction prevents mass/automated abuse), and Technical Impact as 'partial' - aligning closely with the partial C:L/I:L impact in the CVSS vector. The CVE is not listed in CISA KEV, and no public exploit code is indicated in the provided data; there is no public exploit identified at time of analysis. No EPSS score was supplied, so quantitative exploitation probability cannot be stated - this is a data gap rather than a low score. In short, the signals are coherent and all indicate a real but lower-tier risk: a targeted, interaction-dependent XSS against authenticated AEM users rather than a wormable, unauthenticated, widely-exploitable flaw. It warrants patching on a normal cycle, prioritized by the organization's AEM exposure, not emergency out-of-band response.

An authenticated attacker (or one who can lure an authenticated AEM user) crafts a webpage that manipulates the DOM environment so that attacker-controlled JavaScript executes in the victim's browser within the AEM application context. The victim, who must be tricked into visiting the crafted page, has the malicious script run with their session, potentially enabling session/content manipulation. No public exploit code is identified at time of analysis, and the required user interaction and privileges limit realistic abuse to targeted social-engineering.