Adobe Experience Manager DOM-Based Cross-Site Scripting Vulnerability

A DOM-based cross-site scripting vulnerability has been identified in Adobe Experience Manager (AEM) that allows attackers to execute malicious JavaScript in the context of the victim's browser. This vulnerability affects AEM Cloud Service (CS) Release 2026.5.0 and earlier, as well as AEM 6.5 LTS Service Pack 1 and earlier and AEM 6.5 Service Pack 24 and earlier. Exploitation requires user interaction, as the victim must visit a crafted webpage.

Impact

Exploitation of this vulnerability allows for arbitrary code execution in the victim's browser.

Remediation

Users are advised to update to Adobe Experience Manager AEM Cloud Service (CS) Release 2026.6.0, AEM 6.5 LTS Service Pack 2 - Hotfix for NPR-43972, or AEM 6.5 Service Pack 25 - Hotfix for NPR-43971.