Adobe Experience Manager EUVD-2026-100548

Exploitation requires (1) a low-privileged authenticated account on the Adobe Experience Manager instance (CVSS PR:L), and (2) active user interaction - a victim must be induced to visit an attacker-crafted webpage that manipulates the DOM (CVSS UI:R, per the description 'a victim must visit a crafted webpage'). The affected deployments are Adobe Experience Manager 6.5 up to and including 6.5.25. Limiting factors that reduce realistic risk: the attacker cannot act purely unauthenticated, the payload only fires after successful social engineering of a victim into loading the crafted page, and impact is confined to JavaScript execution in the victim's browser context (no direct server availability impact, A:N). These conditions make opportunistic mass exploitation unlikely and favor targeted use against AEM authors/administrators.

This is a moderate-severity (CVSS 5.4) DOM-based XSS in Adobe Experience Manager, and the available signals point to a real but non-urgent priority rather than an emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) shows network reach and low attack complexity, but two meaningful limiters: PR:L means the attacker needs at least low-privileged authenticated access, and UI:R means a victim must be lured into visiting a crafted page. The changed scope (S:C) plus the DOM-XSS nature means code executes in the victim's browser context, outside the vulnerable component's authorization boundary, which is why confidentiality and integrity are rated Low rather than None. No EPSS score, CISA KEV listing, SSVC decision, or POC indicator was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is a vendor-reported (psirt@adobe.com) issue, not a KEV-confirmed one. The absence of exploitation-probability data (EPSS) is a genuine gap; absence should not be read as low risk, but nothing in the data elevates this above routine patch-cycle handling. Net: a legitimate stored/DOM XSS worth remediating on normal timelines, not a high-CVSS-but-illusory issue and not a confirmed-exploited emergency.

A low-privileged authenticated AEM user (or an attacker who has phished such credentials) crafts a URL or page that manipulates the DOM so that attacker-controlled JavaScript executes when a victim - such as an AEM author or administrator - visits it. The injected script runs in the victim's browser session, enabling session-token theft or actions on behalf of the victim. No public exploit was identified in the provided data, so this scenario is inferred from the CVSS vector and CWE-79 classification.