CVE-2026-110073: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager 6.5

CVE-2026-110073 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager 6.5. It enables an attacker with low privileges to inject malicious JavaScript into vulnerable form fields. The injected script executes in the context of users who visit the affected page, potentially leading to information disclosure or session hijacking. The vulnerability affects versions from 0 through 6.5.25 inclusive. The CVSS v3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, changed scope, and limited confidentiality and integrity impact.

An attacker with low privileges can inject malicious scripts that execute in the browsers of users who visit the affected pages. This can lead to limited confidentiality and integrity impacts such as theft of user data or session tokens. There is no impact on availability. The scope of the vulnerability is changed, indicating that the vulnerability affects resources beyond the initially vulnerable component.

No official patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Until a patch is available, users should exercise caution with untrusted input in form fields and consider applying temporary mitigations such as input validation or output encoding where feasible.