Executive brief
Adobe Experience Manager, a content management platform used by enterprises to create and manage digital experiences, is vulnerable to DOM-based cross-site scripting (XSS). An attacker could trick a user into visiting a malicious webpage to execute arbitrary JavaScript code in their browser session, potentially stealing session tokens, credentials, or sensitive data managed through the platform.
Technical details
This vulnerability is a DOM-based cross-site scripting (XSS) flaw that allows an attacker to inject and execute malicious JavaScript code within the Document Object Model of a victim's browser. The vulnerability resides in the Experience Manager application's client-side code and requires user interaction—specifically, the victim must visit or be redirected to a crafted webpage controlled by the attacker. The attack succeeds because the application fails to properly sanitize user-supplied input before using it in DOM operations. An attacker exploiting this issue can steal session cookies, redirect users, perform actions on behalf of the victim, or access sensitive data. Patches are expected to be available through Adobe's security advisories.
Affected products
- Adobe Experience Manager
Timeline
- 2026-09-08: disclosed