CVE-2026-106633: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager 6.5 LTS

CVE-2026-106633 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager 6.5 LTS. It allows an attacker with low privileges to inject malicious JavaScript into form fields that are not properly sanitized. When other users browse pages containing these fields, the malicious script executes in their browsers, potentially leading to information disclosure or session hijacking. The vulnerability affects versions from 0 up to and including 6.5.25. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, and scope change with low confidentiality and integrity impact but no availability impact.

An attacker with low privileges can inject malicious scripts into vulnerable form fields, which execute in the browsers of users who visit the affected pages. This can lead to partial confidentiality and integrity impacts such as theft of sensitive information or unauthorized actions performed in the context of the victim's session. There is no impact on availability. The scope of the vulnerability is changed, indicating that the attack affects resources beyond the vulnerable component.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Until a fix is available, users should apply appropriate input validation and output encoding on form fields to mitigate stored XSS risks. Monitor Adobe's security advisories for updates and patches.