Adobe Experience Manager DOM-Based Cross-Site Scripting Vulnerability

A DOM-based Cross-Site Scripting (XSS) vulnerability has been identified in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, 2026.04 and earlier. This vulnerability allows an attacker to manipulate the DOM environment and execute malicious JavaScript in the context of the victim's browser. Exploitation requires user interaction, as the victim must visit a crafted webpage.

Impact

Successful exploitation allows for arbitrary code execution in the context of the victim's browser.

Remediation

Users are advised to update to Adobe Experience Manager 6.5 LTS Service Pack 2, 6.5 Service Pack 25, or AEM Cloud Service Release 2026.05.