CVE-2026-34625
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker can manipulate the DOM environment to execute malicious JavaScript in the victim's browser. Exploitation requires user interaction – the victim must visit a crafted webpage.
Risk Assessment
An attacker can steal session data, redirect users to malicious sites, or perform other actions in the context of the victim's session, potentially compromising data confidentiality and integrity.
Recommendation
Update Adobe Experience Manager to the latest version that includes an XSS fix. Also restrict embedding of untrusted content.
Original NVD description (English source)
Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage.