CVE-2026-110078: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager 6.5

CVE-2026-110078 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager 6.5. An attacker can exploit this by manipulating the Document Object Model (DOM) environment, causing malicious JavaScript to execute in the context of the victim's browser. This requires user interaction, specifically the victim visiting a crafted webpage. The vulnerability affects versions up to 6.5.25 inclusive. The scope of the vulnerability is changed, indicating that the impact extends beyond the vulnerable component. The CVSS 3.1 score is 5.4, reflecting medium severity with network attack vector, low attack complexity, low privileges required, and user interaction needed. The impact includes limited confidentiality and integrity loss but no availability impact.

Successful exploitation allows execution of arbitrary JavaScript in the victim's browser, potentially leading to limited confidentiality and integrity impacts such as theft of sensitive information or manipulation of web content within the affected application context. There is no impact on availability. The attack requires user interaction (visiting a maliciously crafted webpage).

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted links and consider applying any recommended security configurations from Adobe once available.