CVE-2026-106632: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager 6.5 LTS

CVE-2026-106632 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager 6.5 LTS. An attacker can exploit this by manipulating the DOM environment, causing malicious JavaScript to execute within the victim's browser context. This requires the victim to interact by visiting a specially crafted webpage. The vulnerability affects versions from 0 up to and including 6.5.25. The CVSS 3.1 base score is 5.4 (medium severity) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, user interaction needed, changed scope, and partial confidentiality and integrity impact without availability impact.

Successful exploitation could lead to partial confidentiality and integrity compromise within the victim's browser context. The attacker can execute arbitrary JavaScript, potentially leading to session hijacking, data theft, or other client-side impacts. However, exploitation requires user interaction and low privileges, limiting the ease of attack. There is no known active exploitation in the wild.

No official patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about visiting untrusted or suspicious webpages. Monitor Adobe's official channels for updates and apply patches once released.