Adobe Experience Manager EUVD-2026-100546

Exploitation requires three concrete prerequisites that limit realistic risk: (1) the attacker must hold at least low-level privileges on the AEM instance (CVSS PR:L), so this is not an anonymous internet attack per the vendor vector; (2) a victim with an active AEM session must be socially engineered into visiting a crafted webpage (UI:R), meaning no exploitation occurs without user action; and (3) the target must be running Adobe Experience Manager 6.5 up to and including 6.5.25 - version 6.5.26 or later (per APSB26-152) removes the flaw. The DOM-based nature means the malicious payload is processed entirely in the victim's browser via client-side script, so the specific vulnerable client-side feature/sink in AEM is the trigger, though Adobe's advisory does not name it.

This is a moderate-severity, low-urgency issue rather than an emergency patch. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) shows a network-reachable but constrained flaw: it requires low-level authentication (PR:L) AND victim user interaction (UI:R), which together substantially raise the bar versus an unauthenticated drive-by. Scope is changed (S:C), reflecting that injected script executes in the victim's browser context - a different security authority than the vulnerable server - but impact is only partial (C:L/I:L, A:N). All real-world exploitation signals point low and consistent: SSVC reports Exploitation=none, Automatable=no, Technical Impact=partial; there is no CISA KEV listing and no public exploit identified at time of analysis. The signals do not conflict - CVSS severity, SSVC, and the absence of KEV/POC all converge on 'patch in normal cycle, not out-of-band.' The one nuance worth verifying: DOM-based XSS is frequently assessed as PR:N (unauthenticated) by other analysts, yet Adobe's PSIRT assigned PR:L; if the affected surface is actually a pre-authentication page, real-world reach would be somewhat broader than the score implies.

An attacker with low-privilege access to an affected Adobe Experience Manager 6.5 instance crafts a malicious URL or webpage that manipulates the client-side DOM to inject JavaScript. The attacker lures an authenticated victim into visiting the crafted page, and the script executes in the victim's browser within the AEM context, enabling session/data theft or actions on the victim's behalf. No public exploit code has been identified at time of analysis, and the required user interaction limits mass exploitation.