CVE-2026-34623

CVE-2026-34623 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager versions 6.5.24, FP11.7 and earlier. The flaw allows attackers to manipulate the DOM environment to execute arbitrary JavaScript code within a victim's browser session. Exploitation requires user interaction, as victims must be tricked into visiting a specially crafted malicious webpage. The vulnerability carries a CVSS score of 5.4 (Medium severity) with a network-based attack vector and low attack complexity. While requiring low privileges and user interaction, the potential impact includes limited compromise of confidentiality and integrity, with no availability impact. The FAUCET Risk Score of 41.0 indicates moderate overall risk. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and is not considered active on threat intelligence hotlists. The extremely low EPSS score of 0.0003 suggests minimal probability of exploitation in the wild, indicating this remains primarily a theoretical risk at this time. Organizations should prioritize patching based on their Adobe Experience Manager deployment footprint and exposure to untrusted users.