Adobe Experience Manager EUVD-2026-100535

Exploitation requires the victim to visit an attacker-crafted webpage or URL that manipulates the DOM of Adobe Experience Manager (UI:R), and per the CVSS vector the victim/attacker context carries low privileges (PR:L), indicating an authenticated AEM session is involved rather than a purely anonymous target. Limiting factors that reduce real-world risk: mandatory user interaction (no drive-by against a passive, non-interacting user), the PR:L privilege requirement, and the browser-confined, low-impact nature of DOM XSS (no server-side code execution and no availability impact). Affected deployments are AEM 6.5 up to and including 6.5.25 and AEM 6.5 LTS up to LTS SP3.

This is a medium-severity DOM-based XSS (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) in Adobe Experience Manager, and the available signals consistently point to a lower-tier, non-urgent priority rather than a critical emergency. The CVSS vector shows network reach and low attack complexity but is tempered by two meaningful constraints: required user interaction (UI:R - a victim must visit a crafted page) and a required privilege level (PR:L). Impact is limited to low confidentiality and low integrity with no availability impact, consistent with script execution confined to the victim's browser context; the scope change (S:C) reflects that the injected script crosses from the vulnerable application into the victim's authenticated session. No EPSS score was provided in the input, the CVE is NOT in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. There is no conflict among the signals - all of them (moderate CVSS, no active-exploitation evidence, interaction + privilege prerequisites) align toward 'real but not high priority.' The main missing datum is EPSS, which prevents a quantitative exploitation-probability comparison; patch per normal Adobe cadence rather than treating this as an exploited zero-day.

An attacker crafts a malicious URL or webpage that manipulates the DOM of an Adobe Experience Manager page so that attacker-controlled JavaScript executes in the browser of an authenticated victim (PR:L) who is lured into visiting it (UI:R). The script runs in the victim's AEM session context, enabling session-scoped actions such as reading page data or performing limited actions as the victim. No public exploit code is identified at time of analysis.