CVE-2026-34625 is a DOM-based Cross-Site Scripting vulnerability affecting Adobe Experience Manager versions 6.5.24, FP11.7 and earlier. An attacker can exploit this by manipulating the Document Object Model (DOM) environment to execute arbitrary JavaScript code within the victim's browser session. Successful exploitation requires the victim to interact with a maliciously crafted webpage. The vulnerability is rated medium severity with a CVSS v3.1 base score of 5.4 (Attack Vector: Network, Attack Complexity: Low, Privileges Required: Low, User Interaction: Required, Scope: Changed, Confidentiality and Integrity impact: Low, Availability impact: None). No official fix or patch has been announced as of the publication date.

If exploited, this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, potentially leading to data disclosure or manipulation within the affected application session. However, exploitation requires user interaction and low privileges, limiting the ease of attack. There is no indication of impact on system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted content and avoid visiting suspicious links that could trigger the vulnerability. Monitor Adobe's official security advisories for updates on patches or mitigations.