CVE-2026-107682: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager 6.5

CVE-2026-107682 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager 6.5. An attacker can exploit this by manipulating the DOM environment to execute arbitrary JavaScript code in the victim's browser context. This requires the victim to interact with a maliciously crafted webpage. The vulnerability affects versions from initial releases up to 6.5.25 inclusive. The CVSS v3.1 base score is 5.4 (medium severity) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, user interaction required, changed scope, and limited confidentiality and integrity impact with no availability impact.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to limited confidentiality and integrity impacts such as theft of sensitive information or manipulation of client-side data. The attack requires user interaction and a crafted webpage visit. The scope change indicates that the vulnerability crosses security boundaries within the application, increasing potential impact.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted content and avoid visiting suspicious webpages. Since this is a DOM-based XSS requiring user interaction, user education and browser security controls may help mitigate risk.