Adobe Experience Manager EUVD-2026-100559

Exploitation requires an authenticated/low-privileged context (PR:L) combined with victim user interaction: the victim must visit an attacker-crafted webpage or URL that manipulates the client-side DOM, per the description. The flaw is a DOM-based XSS, so the malicious payload executes client-side in the victim's browser rather than requiring server-side injection. Limiting factors that reduce realistic risk: the attacker cannot succeed without luring a victim to the crafted page (no fully automated server-side trigger), low privileges are needed on the AEM environment, and impact is confined to the victim's browser session (C:L/I:L, no availability impact). Affected deployments are AEM 6.5 up to 6.5.25, AEM 6.5 LTS up to SP3, and AEM as a Cloud Service up to 2026.9.28187; patched/later versions are not affected.

This is a moderate-severity (CVSS 5.4) DOM-based XSS in Adobe Experience Manager with a balanced, non-alarming risk profile. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N indicates network-reachable, low-complexity exploitation but with two significant mitigating factors: it requires some level of authentication/privilege (PR:L) and victim user interaction (UI:R - the victim must visit a crafted webpage). The changed scope (S:C) and dual low Confidentiality/Integrity impact (C:L/I:L) reflect that injected script executes in the victim's browser context, potentially crossing a security boundary, but impact is limited to low rather than high. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input. There is no public exploit identified at time of analysis and no evidence of active exploitation. Overall this is a real but not urgent issue - a typical patch-in-normal-cycle web vulnerability rather than an emergency; the combination of required privileges plus required user interaction meaningfully raises the bar for an attacker. Absence of EPSS/KEV data means the real-world exploitation likelihood cannot be quantified from the provided signals and should not be assumed to be high.

An attacker with low-privilege access to an Adobe Experience Manager instance crafts a malicious URL or page that manipulates the client-side DOM so that attacker-controlled JavaScript executes when a victim (e.g., an authenticated AEM author or administrator) opens the crafted link. The script then runs in the victim's browser session within the AEM origin, enabling session/data theft or actions in the victim's context. No public exploit code was identified in the provided data, and successful exploitation depends on convincing the victim to visit the crafted page (UI:R).