Adobe Experience Manager EUVD-2026-100542

Exploitation requires an authenticated low-privileged account on Adobe Experience Manager (6.5 through 6.5.25) with the ability to submit input into the vulnerable form field, per PR:L. The injected script is stored and only executes when a victim user browses to the page rendering that field, so successful attack depends on victim interaction (UI:R) and on a target user - ideally a higher-privileged one - actually viewing the affected content. Limiting factors: no anonymous/unauthenticated path, mandatory victim browsing action, and applicability only to the affected 6.5.x branch at or below 6.5.25; patched builds above 6.5.25 (per APSB26-152) remove the exposure.

This is a moderate-severity stored XSS (CVSS 5.4, CWE-79) with a network attack vector and low complexity, but two meaningful friction points keep real-world risk measured rather than urgent: the attacker must already hold low-privileged authenticated access (PR:L) to inject into vulnerable form fields, and a victim must actively browse to the affected page (UI:R) for the payload to fire. The scope-changed flag (S:C) and the subsequent execution of attacker JavaScript in a victim's browser session are what elevate this above a trivial self-XSS. No EPSS score, KEV listing, or POC was provided in the input, so there is no signal of active or probable exploitation - this reads as a standard enterprise-CMS stored XSS rather than a priority emergency. The signals are internally consistent (network-reachable authoring interface, low-priv injection, victim interaction), with no contradiction between the CVSS vector and the description. Primary risk is session hijacking / action-on-behalf-of a higher-privileged user (e.g., an administrator previewing author content) within the AEM context.

A low-privileged AEM author user injects a malicious JavaScript payload into a vulnerable form field that is persisted server-side. When a higher-privileged user (such as a content reviewer or administrator) later browses to the page rendering that field, the script executes in their authenticated browser session, enabling session-token theft or actions performed as the victim. No public exploit code was identified at time of analysis, and because UI is required, the attack depends on a victim visiting the poisoned page.