CVE-2026-106629: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager 6.5 LTS

CVE-2026-106629 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager 6.5 LTS. The flaw allows an attacker to inject malicious JavaScript into vulnerable form fields, which executes in the context of a victim's browser upon visiting the affected page. This can result in elevated access or control over the victim's account or session. The vulnerability affects versions from 0 up to and including 6.5.25. The CVSS v3.1 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity.

Successful exploitation of this stored XSS vulnerability can lead to execution of arbitrary JavaScript in the victim's browser, potentially allowing attackers to hijack user sessions, steal sensitive information, or perform actions with the victim's privileges within Adobe Experience Manager. The confidentiality and integrity impacts are rated high, while availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix links are provided in the available data. Until a patch is available, users should exercise caution when interacting with untrusted content and consider applying any recommended temporary mitigations from Adobe once available.