CVE-2026-110081: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager 6.5 LTS

CVE-2026-110081 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager 6.5 LTS. It permits a low-privileged attacker to inject malicious JavaScript into vulnerable form fields, which executes in the context of users visiting the affected pages. The vulnerability impacts versions from 0 up to and including 6.5.25. The CVSS 3.1 base score is 5.4, indicating medium severity, with attack vector network, low attack complexity, low privileges required, and user interaction required. The scope is changed, and the impact includes low confidentiality and integrity impacts but no availability impact.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of users who visit the affected pages, potentially leading to information disclosure or manipulation of user interactions within the application context. The impact is limited to confidentiality and integrity with no availability impact. There are no known exploits in the wild at this time.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should apply standard XSS mitigations such as input validation and output encoding on form fields if possible.