Adobe Experience Manager EUVD-2026-100538

Exploitation requires an authenticated low-privileged AEM account (PR:L) with the ability to write content into a form field that is later rendered to other users - i.e. an attacker who can author or edit form input in Adobe Experience Manager 6.5 up to and including 6.5.25. Successful payload execution additionally requires victim user interaction: a separate victim must browse to the page containing the attacker-controlled field (UI:R), so there is no automatic or unauthenticated path. These two limiting factors - required low-privilege authentication and required victim page visit - meaningfully reduce real-world risk below what a raw network-vector reading might suggest; exposure is highest on multi-author AEM instances where low-trust content contributors exist.

This is a moderate-severity stored XSS (CVSS 5.4) and the signals are internally consistent rather than conflicting. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N shows a network-reachable but AUTHENTICATED (PR:L) attack that requires victim interaction (UI:R), with only Low confidentiality and Low integrity impact and no availability impact - the scope change (S:C) reflects script execution crossing from the attacker-controlled form field into a victim's browser session, which is what elevates the score from the low-4 range into the mid-5 range. No EPSS probability was supplied in the input, there is no CISA KEV listing, and no public exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' SSVC-style reasoning puts this at a 'Track'/low-urgency posture, not 'Act': exploitation is not observed, it is not automatable (each attack needs a targeted authenticated injection plus a victim visit), and technical impact is partial, not total. Net: this is a real but non-critical issue best handled on a normal patch cadence - not a high-CVSS-but-illusory finding, but also not an emergency. Missing data to note explicitly: no EPSS score and no vendor-stated exploitation claim were provided, so widespread-exploitation likelihood cannot be quantified from the input.

A low-privileged authenticated user of Adobe Experience Manager (e.g. a content author or form editor) injects malicious JavaScript into a vulnerable form field, which is stored by the application. When a higher-privileged user or site visitor later browses to the page rendering that field, the script executes in their browser under the AEM origin, enabling session or content theft actions. No public proof-of-concept exploit is identified at time of analysis.