CVE-2026-110079: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager 6.5

CVE-2026-110079 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager 6.5. An attacker can exploit this by manipulating the Document Object Model (DOM) environment to execute arbitrary JavaScript code within the victim's browser context. This requires the victim to interact with a maliciously crafted webpage. The vulnerability affects versions from 0 up to and including 6.5.25. The vulnerability has a CVSS v3.1 base score of 5.4, indicating medium severity, with attack vector network, low attack complexity, low privileges required, and user interaction needed. The scope is changed, and the impact includes low confidentiality and integrity impacts but no availability impact.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to information disclosure and integrity compromise within the context of the affected web application. However, the attack requires user interaction and low privileges, limiting the ease of exploitation. There is no impact on availability.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted links and consider applying any recommended workarounds from Adobe once available.