CVE-2026-110080: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager 6.5

CVE-2026-110080 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager 6.5. An attacker can exploit this vulnerability by manipulating the Document Object Model (DOM) environment, causing malicious JavaScript to execute within the victim's browser context. This requires the victim to interact by visiting a specially crafted webpage. The vulnerability affects versions from 0 through 6.5.25 inclusive. The scope of the vulnerability is changed, indicating that the impact extends beyond the vulnerable component. The CVSS v3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, low privileges required, user interaction required, changed scope, and impacts on confidentiality and integrity but not availability.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to information disclosure and integrity impacts within the affected application session. The attack requires user interaction (visiting a malicious webpage). There is no indication of availability impact or known exploits in the wild at this time.

No official patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted links and consider applying any recommended workarounds from Adobe once available.