CVE-2026-110075: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager 6.5

CVE-2026-110075 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager 6.5. An attacker can exploit this by manipulating the Document Object Model (DOM) environment to execute arbitrary JavaScript code within the context of a victim's browser. Successful exploitation requires the victim to interact with a maliciously crafted webpage. The vulnerability affects confidentiality and integrity with a CVSS 3.1 base score of 5.4 (medium severity). The scope is changed, meaning the vulnerability crosses security boundaries within the application.

Exploitation of this vulnerability can lead to the execution of arbitrary JavaScript code in the context of the victim's browser, potentially allowing an attacker to steal sensitive information or perform actions on behalf of the user. The impact is limited to confidentiality and integrity, with no impact on availability. User interaction is required for exploitation, reducing the likelihood of automated attacks.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted webpages and consider applying any recommended workarounds or mitigations from Adobe once available.