Adobe Experience Manager EUVD-2026-100558

Exploitation requires an attacker to lure a victim into visiting a maliciously crafted URL or interacting with a compromised web page that reflects the XSS payload back into an Adobe Experience Manager page (UI:R). No attacker authentication is needed per the CVSS vector (PR:N), and the affected instance must be network-reachable to the victim. The principal limiting factor is the mandatory user interaction, and realistic high-impact outcomes depend on the victim being an authenticated/privileged AEM user (author or administrator) whose session the injected script can abuse; no special non-default configuration is stated as a precondition. Affected deployments: AEM 6.5 up to 6.5.25, AEM as a Cloud Service up to 2026.9.28187, and AEM 6.5 LTS up to SP3.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, base 9.3) describes a network-reachable, low-complexity, unauthenticated reflected XSS whose only barrier is user interaction and whose scope change plus High confidentiality/integrity impact drive the Critical score. These signals are partly in tension: a reflected (CWE-79) XSS is operationally a per-victim, interaction-dependent attack, not an unauthenticated server takeover, so the 9.3 is largely a function of Adobe scoring session/account compromise as S:C with C:H/I:H - a defensible but aggressive rating for reflected XSS, where C:L/I:L is more typical. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. Net assessment: a genuinely high-severity flaw in a widely deployed enterprise CMS that warrants prompt patching, but in the absence of KEV/EPSS/POC signals it currently reads as high-CVSS-driven-by-impact-weighting rather than demonstrated widespread exploitation - prioritize patching of internet-facing AEM instances while treating the 9.3 as an upper-bound estimate pending exploitation telemetry.

An attacker crafts a malicious URL targeting a vulnerable reflected-XSS parameter in an Adobe Experience Manager page and delivers it via phishing or a compromised site. When an authenticated AEM user (e.g., an author or administrator) clicks the link, the injected script executes in their session context, letting the attacker steal session tokens or perform actions as that user. No public exploit code was identified at time of analysis, and because AV:N/AC:L but UI:R, success hinges on tricking a privileged victim into visiting the link.