DOM-based Cross-Site Scripting Vulnerability in Adobe Experience Manager
CVE-2026-110074

5.4MEDIUM

Key Information:

Vendor

Adobe
Status
Adobe Experience Manager 6.5 Lts
Adobe Experience Manager 6.5
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110074?

A DOM-based Cross-Site Scripting vulnerability exists in Adobe Experience Manager, allowing attackers to craft a malicious webpage that, when visited by users, can execute harmful JavaScript within the context of their browsers. This exploitation relies on user interaction, emphasizing the need for users to be cautious about the sites they visit. Addressing this vulnerability is crucial for maintaining web application security and protecting user data.

Affected Version(s)

Adobe Experience Manager 6.5 0 <= 6.5.25

Adobe Experience Manager 6.5 LTS 0 <= 6.5 LTS SP3

Adobe Experience Manager 6.5 6.5.23 - Hotfix for GRANITE-75052, 6.5.24 - Hotfix for GRANITE-75052, 6.5.25 - Hotfix for GRANITE-75052

References

https://helpx.adobe.com/security/products/experience-mana...
vendor-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.