CVE-2026-110083: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) in Adobe Adobe Experience Manager 6.5

CVE-2026-110083 describes an SQL Injection vulnerability in Adobe Experience Manager 6.5. This vulnerability arises from improper neutralization of special elements in SQL commands, enabling a low-privileged attacker to bypass security controls and obtain unauthorized read and limited write access to the system. The flaw does not require user interaction to exploit. The affected versions include all releases up to and including 6.5.25.

An attacker with low privileges can exploit this vulnerability to bypass security features, gaining unauthorized read access and limited write capabilities. This could lead to exposure of sensitive data and partial modification of data within the affected Adobe Experience Manager instance. There is no indication of denial of service or full system compromise. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor Adobe's security advisories for updates. Until a fix is available, restrict access to Adobe Experience Manager instances and apply compensating controls as appropriate.