Adobe Experience Manager EUVD-2026-100549

Exploitation requires an attacker to hold a low-privilege authenticated account on the Adobe Experience Manager instance (CVSS PR:L) AND to induce an authenticated victim to visit an attacker-crafted webpage (CVSS UI:R) - both conditions must be met, which significantly limits mass or drive-by exploitation. The flaw is a DOM-based XSS (CWE-79) where attacker-controlled input reaches a client-side DOM sink in AEM without sanitization; it affects AEM 6.5.0 through 6.5.25. Limiting factors: mandatory authentication, mandatory social-engineering/user-interaction step, and impact confined to the victim's browser session (Low confidentiality and integrity, no availability impact). The scope-changed metric (S:C) means executed script acts beyond the vulnerable component's security authority (victim browser/session).

This is a moderate-severity DOM-based XSS (CVSS 3.1 base 6.1 per the provided vector, though the input lists 5.4 - note this discrepancy and verify with Adobe APSB26-152). The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N indicates a network-reachable, low-complexity flaw that nonetheless requires BOTH low-privilege authentication (PR:L) AND victim user interaction (UI:R), with a changed scope (S:C) reflecting that injected script executes in the victim browser context beyond the vulnerable component. No EPSS score, KEV listing, or POC was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of required authentication plus required user interaction substantially lowers real-world risk relative to the 'network' vector: this is not a wormable, unauthenticated RCE but a classic client-side injection with only Low confidentiality and Low integrity impact and no availability impact. Treat as a routine-to-moderate patch priority (standard Adobe Priority 3-type cadence) rather than an emergency, absent any exploitation signal. The main unknowns are the absence of EPSS/KEV/POC data and the CVSS score/vector arithmetic mismatch noted above.

An attacker with low-privilege access to an Adobe Experience Manager instance crafts a malicious webpage (or a URL/link containing attacker-controlled DOM-influencing input) and lures an authenticated AEM user into visiting it. When the victim's browser processes the crafted content, client-side JavaScript in the vulnerable AEM page sinks the attacker input into the DOM without proper sanitization, executing arbitrary JavaScript in the victim's authenticated session context. No public exploit code was provided in the intelligence.