CVE-2026-110084: XML Injection (aka Blind XPath Injection) (CWE-91) in Adobe Adobe Experience Manager 6.5

CVE-2026-110084 is an XML Injection vulnerability in Adobe Experience Manager 6.5 that enables an attacker with low privileges to bypass security controls. Exploitation does not require user interaction and can lead to unauthorized read access and limited write access. The vulnerability is identified as CWE-91 (XML Injection / Blind XPath Injection). It affects versions from 0 up to and including 6.5.25. No patch or remediation information is provided in the input data.

Successful exploitation allows an attacker with low privileges to bypass security features, resulting in unauthorized read access and limited write access to the system. This could compromise confidentiality and integrity of data managed by Adobe Experience Manager 6.5. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Adobe's security advisories for updates. Until a fix is available, consider restricting access to affected systems and applying compensating controls to limit exposure.