CVE-2026-106628: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager 6.5 LTS

CVE-2026-106628 describes a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager 6.5 LTS. An attacker can exploit this vulnerability by manipulating the Document Object Model (DOM) environment to execute arbitrary JavaScript code within the context of a victim's browser. Successful exploitation requires the victim to interact by visiting a maliciously crafted webpage. The vulnerability affects confidentiality and integrity with a CVSS v3.1 base score of 5.4 (medium severity). The scope is changed, indicating the vulnerability affects components beyond the initially vulnerable code. No known exploits are reported in the wild, and Adobe Experience Manager is not a cloud service in this context.

The vulnerability allows an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to information disclosure and modification of data within the affected application. There is no impact on availability. The medium severity score reflects the limited but meaningful impact on confidentiality and integrity. Exploitation requires user interaction, reducing the likelihood of automated widespread exploitation.

No official patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted content and consider applying any recommended security controls from Adobe once available.