CVE-2026-34692
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser.
Risk Assessment
Exploitation of this issue may lead to theft of user data or session hijacking. It requires user interaction, which increases the risk if a malicious webpage is visited.
Recommendation
It is recommended to update to the latest version of Adobe Experience Manager to mitigate this vulnerability. Additionally, users should be educated about the risks of visiting unknown websites.
Original NVD description (English source)
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.