Adobe Experience Manager EUVD-2026-100543

Exploitation requires (1) the attacker to craft a webpage/input that reaches a vulnerable client-side DOM sink in Adobe Experience Manager, and (2) a victim to actively visit that crafted page (UI:R). Per the CVSS vector, the attacker holds low-level privileges (PR:L), meaning some authenticated AEM access is expected rather than fully anonymous exploitation; impact is limited to Low confidentiality and Low integrity in the victim's browser session with no availability impact. Limiting factors: the mandatory victim interaction, the attacker-authentication requirement, and the bounded (non-admin-takeover, non-RCE) impact of a DOM-XSS payload constrain realistic risk below the network-reachable CVSS surface. Affected deployments are AEM 6.5 LTS through SP3 and AEM 6.5 through 6.5.25.

This is a moderate-severity (CVSS 5.4) DOM-based XSS in Adobe Experience Manager, and the signals align toward a genuine-but-not-urgent priority rather than an emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates network-reachable, low-complexity exploitation but requires both low-level privileges (PR:L) and victim user interaction (UI:R), with only Low confidentiality and integrity impact and no availability impact - the Changed scope (S:C) reflects that injected script executes in the victim's browser context beyond the vulnerable component. No EPSS score, SSVC decision data, KEV listing, or POC were provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The absence of EPSS/KEV is consistent with the modest CVSS and the typical low mass-exploitation rate of authenticated, interaction-dependent XSS. One point to verify with the vendor: Adobe assigned PR:L, implying the attacker needs some authenticated AEM access (e.g., an author/contributor able to seed a DOM sink), yet the description frames exploitation purely as a victim visiting a crafted webpage, which could suggest a lower privilege barrier - the realistic prerequisite (attacker authentication vs. none) should be confirmed against the Adobe advisory APSB26-152.

An attacker with low-level access crafts or poisons a page/parameter that feeds unsanitized input into a client-side DOM sink in Adobe Experience Manager, then lures an authenticated victim (e.g., an author or admin) to visit the crafted URL. When the victim's browser processes the manipulated DOM, attacker-controlled JavaScript executes in the victim's AEM session context, enabling session/action abuse. No public exploit code was provided in the intelligence, and low attack complexity (AC:L) makes crafting the payload straightforward once the sink is known.