Adobe Experience Manager EUVD-2026-100539

Exploitation requires a DOM-based XSS sink reached when a victim visits an attacker-crafted webpage (UI:R) - the attacker manipulates the DOM environment so that attacker-controlled data flows into a client-side script sink in the AEM UI. Per the CVSS vector, the attacker also needs low-privilege authenticated access to AEM (PR:L), so this is not an unauthenticated drive-by. Limiting factors that reduce realistic risk: mandatory victim user interaction (clicking/visiting the crafted page), the required low-privilege account, and the impact being confined to script execution in the victim's browser session (C:L/I:L, A:N) rather than direct server compromise. Affected deployments are Adobe Experience Manager 6.5 through 6.5.25.

This is a medium-severity (CVSS 5.4) DOM-based XSS in Adobe Experience Manager, and the combined signals point to a moderate, not urgent, priority. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) shows network reachability and low attack complexity, but two real brakes on exploitation: PR:L means the attacker needs at least low-privilege authentication, and UI:R means a victim must be lured into visiting a crafted page. The changed scope (S:C) and low-but-dual C:L/I:L impact reflect script execution in the victim's browser context rather than compromise of the AEM server itself. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT on the CISA KEV list and no POC was supplied, so there is no public exploit identified at time of analysis. Net: this is a legitimate issue to patch in normal cycles, not a high-CVSS-but-illusory risk, but it is also not evidence of active, widespread exploitation - the authentication requirement plus required user interaction make it closer to a targeted/social-engineering scenario than a drive-by mass-exploitation threat.

A low-privileged authenticated user crafts content or a URL that injects attacker-controlled data into a DOM sink in the AEM interface, then lures a higher-privileged victim (e.g., an author or administrator) into opening the crafted page. When the victim's browser renders it, malicious JavaScript executes in the victim's AEM session context, enabling session/action abuse within that browser. No public exploit code was identified in the provided data.