CVE-2026-110077: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager 6.5

CVE-2026-110077 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager 6.5. An attacker can manipulate the Document Object Model (DOM) environment to execute arbitrary JavaScript code within the victim's browser context. This requires the victim to interact by visiting a maliciously crafted webpage. The vulnerability affects versions from the initial release up to 6.5.25 inclusive. The vulnerability has a CVSS 3.1 base score of 5.4, with network attack vector, low attack complexity, privileges required, user interaction required, changed scope, and impacts on confidentiality and integrity but not availability.

Successful exploitation can lead to the execution of arbitrary JavaScript in the victim's browser, potentially allowing an attacker to steal sensitive information or perform actions on behalf of the user within the affected application context. The vulnerability impacts confidentiality and integrity but does not affect availability. Exploitation requires user interaction and privileges, limiting the ease of exploitation.

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted links and consider applying any official updates from Adobe once released.