Adobe Experience Manager EUVD-2026-100560

Exploitation requires that a victim with an active AEM session visit an attacker-crafted webpage or URL that manipulates the DOM (UI:R), and the CVSS vector's PR:L indicates the attacker/context also requires low-privilege access to the application rather than being fully anonymous. Limiting factors: the mandatory user-interaction step (the victim must be socially engineered into opening the crafted page), the low-privilege precondition, and the limited impact (information/integrity at Low, no availability impact). Affected deployments are AEM 6.5 up to 6.5.25, AEM 6.5 LTS up to SP3, and AEM as a Cloud Service up to 2026.9.28187; patched versions are not exploitable.

This is a moderate-severity (CVSS 5.4) DOM-based XSS in Adobe Experience Manager with a mixed risk signal profile. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates network reach with low attack complexity, but two meaningful friction factors cap the severity: PR:L means the attacker needs some level of authenticated/low-privilege access, and UI:R means a victim must be lured into visiting a crafted webpage. The changed scope (S:C) raises the ceiling because injected script executes in the victim's browser context rather than purely within the vulnerable component, but impacts are limited (C:L/I:L, A:N) - typical of reflected/DOM XSS (session/UI manipulation rather than full account or server takeover). No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this reads as a standard vendor-disclosed (psirt@adobe.com) hygiene fix rather than an urgent, under-attack priority. Net: prioritize as routine patch-cycle remediation weighted up for AEM's broad enterprise footprint, not as an emergency. No conflicting signals were observed, though the absence of EPSS/KEV/POC data means exploitation likelihood cannot be quantified from the provided sources.

An attacker with low-privilege access to an AEM instance crafts a malicious URL or webpage that manipulates the DOM environment, then lures an authenticated victim (e.g., a content author or admin) into visiting it. When the victim's browser processes the crafted input, attacker-controlled JavaScript executes in the AEM application context, enabling session actions or UI manipulation on the victim's behalf. No public proof-of-concept was provided in the input, so exploitation is currently theoretical based on the advisory.