CVE-2026-34625

CVE-2026-34625 is a DOM-based Cross-Site Scripting vulnerability affecting Adobe Experience Manager versions 6.5.24, FP11.7 and earlier. An attacker can exploit this issue by manipulating the DOM environment to execute arbitrary JavaScript in a victim's browser, though successful exploitation requires the victim to visit a crafted webpage. The vulnerability carries a CVSS score of 5.4 (Medium severity) with a network-based attack vector, low complexity, and low privilege requirements. The potential impact is limited to confidentiality and integrity compromise, with no availability impact, and the attack requires user interaction. Current exploitation status indicates this vulnerability is not actively exploited in the wild, with no public exploit code available and minimal community attention, as evidenced by its inactive status on vulnerability tracking lists and very low EPSS score of 0.0003.