Adobe Experience Manager EUVD-2026-100556

Exploitation requires the attacker to craft a webpage/URL that manipulates the DOM environment so unsanitized input reaches a client-side DOM sink, AND a victim must actively visit that crafted page (UI:R) - the attack cannot be automated or performed silently against a server. Per the CVSS vector the victim also needs low-level privileges (PR:L), implying an authenticated AEM session rather than a fully anonymous target; this authentication requirement and the mandatory social-engineering/user-interaction step are the primary factors limiting real-world exploitation. Affected deployments are Adobe Experience Manager 6.5 up to and including 6.5.25; later versions are not affected.

This is a moderate-severity (CVSS 5.4) DOM-based XSS in Adobe Experience Manager, and the aggregated signals consistently point to a LOW real-world priority rather than an urgent threat. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) shows network reach and low attack complexity but is tempered by two meaningful constraints: it requires some privileges (PR:L) and victim user interaction (UI:R), and impact is only partial (C:L/I:L, no availability impact). CISA's SSVC framework reinforces this: Exploitation=none (no observed or proven exploitation), Automatable=no (cannot be mass-scripted because a victim must be lured into interacting), and Technical Impact=partial. There is no EPSS score, no CISA KEV listing, and no public exploit in the provided data - all three absent signals align with the SSVC 'none' exploitation state rather than conflicting with it. No signals are in tension here; the low-privilege requirement plus mandatory user interaction and bounded (partial) impact collectively justify treating this as routine patch-cycle remediation, not an emergency. Note one point to verify with the vendor: Adobe assigned PR:L, but many DOM-based XSS flaws are reachable pre-authentication - confirm whether exploitation genuinely requires an authenticated session.

An attacker crafts a malicious URL or webpage that manipulates the DOM of an Adobe Experience Manager page so that attacker-controlled input is written into the page without proper sanitization. When an authenticated victim (PR:L) is socially engineered into visiting the crafted page (UI:R), attacker-supplied JavaScript executes in the victim's browser within the AEM origin, potentially stealing session context or performing actions as the victim. No public exploit code has been identified at time of analysis.