CVE-2026-109415: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager 6.5 LTS

CVE-2026-109415 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager 6.5 LTS. It enables a low-privileged attacker to inject malicious JavaScript into vulnerable form fields, which executes in the context of users who visit the affected pages. The vulnerability affects versions from 0 up to and including 6.5.25. The CVSS 3.1 base score is 5.4, indicating medium severity, with attack vector network, low attack complexity, low privileges required, user interaction required, scope changed, and impacts on confidentiality and integrity but not availability.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of users visiting the affected pages, potentially leading to information disclosure or manipulation of user interactions. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Until a fix is available, users should be cautious with untrusted input in form fields and consider applying any recommended workarounds from Adobe.