CVE-2026-110037: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager 6.5 LTS

CVE-2026-110037 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager 6.5 LTS. It enables a low-privileged attacker to inject malicious JavaScript into form fields that are not properly sanitized. The injected script executes in the context of a victim's browser when they access the affected page, potentially leading to information disclosure or session hijacking. The vulnerability affects versions from 0 up to and including 6.5.25. The scope of the vulnerability is changed, indicating that the impact extends beyond the initially affected component.

An attacker with low privileges can inject malicious scripts that execute in the browsers of users who visit the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of user data or session tokens. There is no impact on availability. No known exploits are reported in the wild at this time.

No official patch or fix information is provided in the vendor advisory or patch links. Patch status is not yet confirmed — check the Adobe advisory for current remediation guidance. Until a fix is available, users should apply standard XSS mitigations such as input validation and output encoding on vulnerable fields if possible.