CVE-2026-34624

CVE-2026-34624 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager versions 6.5.24, FP11.7 and earlier. An attacker could manipulate the DOM environment to execute malicious JavaScript within a victim's browser by convincing them to visit a crafted webpage. This vulnerability requires user interaction and authenticated access to exploit. The vulnerability carries a CVSS score of 5.4 (Medium severity) with a network-based attack vector, low complexity, and a requirement for low privileges and user interaction. While the impact is limited to low-level confidentiality and integrity compromise with no availability impact, the scope is changed, meaning the vulnerability can affect resources beyond the vulnerable component. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hot lists. With an EPSS score of 0.000310000 indicating minimal probability of exploitation in the wild, there is no evidence of active exploitation or publicly available exploit code at this time. Organizations should still apply available patches to maintain security posture, though immediate remediation urgency is low.