Adobe Experience Manager EUVD-2026-100545

Exploitation requires (1) a low-privileged authenticated context in Adobe Experience Manager (PR:L) - the attacker needs some level of valid access rather than being fully anonymous - and (2) victim user interaction (UI:R): a victim user must visit an attacker-crafted webpage or URL that manipulates the DOM to inject script. The vulnerability affects AEM 6.5 up to and including 6.5.25. Limiting factors that reduce realistic risk: the mandatory user-interaction step prevents fully automated/wormable exploitation, the required low-privilege foothold narrows the attacker pool, and impact is limited to Low confidentiality and Low integrity with no availability effect; the changed scope (S:C) means impact lands in the victim's browser context beyond the vulnerable component.

This is a moderate-severity (CVSS 5.4), authenticated DOM-based XSS in Adobe Experience Manager, and the available signals consistently point to a lower-priority issue rather than an urgent one. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) shows network reachability and low complexity, but two meaningful frictions: it requires existing low-level privileges (PR:L) and victim user interaction (UI:R), and both confidentiality and integrity impact are only Low. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of exploitation activity - exploitation status is 'no public exploit identified at time of analysis.' The changed scope (S:C) is the one factor that elevates impact, reflecting that injected script executes in the victim's browser context rather than the vulnerable component alone, which is typical of reflected/DOM XSS. On balance this is a real but routine web-application flaw to patch in normal cycles, not a high-real-risk emergency; the combination of required privileges plus user interaction substantially limits mass or automated exploitation.

An attacker with low-privileged access crafts a malicious URL or webpage that manipulates the DOM of an AEM interface so that attacker-controlled JavaScript executes when an authenticated victim (e.g., an AEM author or administrator) visits it. The script then runs in the victim's browser session, enabling actions such as stealing session context or performing requests as the victim. No public exploit code is identified, and successful attack requires the victim to interact by visiting the crafted page (UI:R), with low attack complexity once that occurs.