Adobe Experience Manager DOM-Based Cross-Site Scripting Vulnerability

A DOM-based Cross-Site Scripting (XSS) vulnerability has been identified in Adobe Experience Manager (AEM) versions 6.5.23 and earlier. This vulnerability allows a low-privileged attacker to execute malicious scripts in the context of the victim's browser. Exploitation requires user interaction, such as visiting a crafted URL or engaging with a manipulated web page.

Impact

Successful exploitation allows for arbitrary code execution in the context of the victim's browser.

Remediation

Users are advised to update to Adobe Experience Manager 6.5.24 or AEM Cloud Service Release 2025.12. Instructions for updating can be found in the release notes for Adobe Experience Manager 6.5 LTS SP1 (Granite-61551 Hotfix) and Adobe Experience Manager Cloud Service.