CVE-2026-106631: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager 6.5 LTS

CVE-2026-106631 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager 6.5 LTS. A low-privileged attacker can exploit vulnerable form fields to inject malicious JavaScript, which executes in the context of users visiting the affected pages. This can lead to scope changes and impacts confidentiality and integrity. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and scope changed, with partial confidentiality and integrity impacts but no availability impact.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of users' browsers when they access the affected pages. This can lead to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality and integrity. There is no direct impact on availability. The vulnerability affects versions up to 6.5.25 of Adobe Experience Manager 6.5 LTS.

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to vulnerable form fields and apply input validation or sanitization where possible to mitigate injection of malicious scripts.