CVE-2026-110076: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager 6.5

CVE-2026-110076 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager 6.5. It enables an attacker to execute arbitrary JavaScript by manipulating the DOM environment when a victim visits a maliciously crafted webpage. The vulnerability changes the scope and requires user interaction for exploitation. The affected versions include all releases from 0 through 6.5.25 inclusive. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, low privileges required, and user interaction needed. Confidentiality and integrity impacts are low, with no availability impact.

Successful exploitation could allow an attacker to execute malicious scripts in the victim's browser, potentially leading to information disclosure and integrity compromise within the context of the affected web application. However, exploitation requires user interaction and a crafted webpage. There is no indication of availability impact or known exploits in the wild at this time.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about visiting untrusted or suspicious webpages and consider applying any recommended security configurations from Adobe.