Adobe Experience Manager EUVD-2026-100544

Exploitation requires the DOM-based XSS sink in Adobe Experience Manager (versions 6.5 up to and including 6.5.25) to be reachable, the attacker to possess low-level privileges (PR:L) on the instance, and a victim to be socially engineered into visiting a specially crafted webpage/URL (UI:R) that manipulates the client-side DOM. These user-interaction and authentication requirements, combined with only partial confidentiality/integrity impact and no availability impact, meaningfully limit mass exploitation; the realistic exposure is greatest on internet-reachable AEM author/publish instances where low-privilege accounts exist. Confirm with Adobe whether an authenticated session is strictly necessary, as the vendor's PR:L assignment is unusual for DOM XSS and directly affects exposure.

This is a moderate-severity DOM-based XSS (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) in Adobe Experience Manager, reported by Adobe's own PSIRT. The signals are internally consistent and point to a genuine-but-not-urgent issue rather than a critical priority. The attack vector is network-reachable with low complexity, but two factors materially constrain real-world risk: PR:L means the attacker needs some level of authenticated/low privilege, and UI:R means a victim must actively visit a crafted webpage. The changed scope (S:C) plus low confidentiality and integrity impact (C:L/I:L, A:N) reflects typical client-side script execution that can cross a security boundary (e.g., affecting the victim's session/browser context beyond the vulnerable component) but does not grant full system compromise. No EPSS score, KEV listing, or POC is present in the provided data, so there is no evidence of active exploitation or public exploit code. Net: a legitimate flaw worth patching in the normal cycle, not an emergency. Note one point to verify: DOM-based XSS is often assessed as PR:N, yet Adobe assigned PR:L - confirm with the vendor whether an authenticated session is truly required, as this affects exposure of internet-facing author/publish instances.

An attacker with low-privilege access crafts a malicious URL or webpage that manipulates the AEM DOM environment so that attacker-controlled JavaScript executes in the victim's browser session when the victim visits it. Because scope is changed, the injected script can act beyond the vulnerable component - for example hijacking the authenticated user's session context or performing actions as that user. No public exploit code is identified in the available data, so exploitation would require the attacker to independently develop the payload.