CVE-2026-106630: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager 6.5 LTS

CVE-2026-106630 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager 6.5 LTS. An attacker can exploit vulnerable form fields to inject malicious JavaScript, which executes in the context of a victim's browser upon visiting the affected page. This can result in elevated privileges or session compromise. The vulnerability affects versions from 0 up to and including 6.5.25. The CVSS v3.1 base score is 9.3, indicating critical impact with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high confidentiality and integrity impacts.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to account takeover or session hijacking. The vulnerability affects confidentiality and integrity but does not impact availability.

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using vulnerable form fields or restrict access to affected pages. Monitor Adobe's official channels for updates.