CVE-2026-110076: Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The CVSS vector indicates that the attacker needs low-level privileges. The attack can be conducted over the network and has low attack complexity.
Is victim interaction required for exploitation?
Yes. A victim must visit an attacker-crafted webpage for the malicious JavaScript to execute in the victim's browser context.
What is the expected security impact?
The issue is rated medium severity with a CVSS score of 5.4. It can result in low confidentiality and integrity impact, with no availability impact indicated; the CVSS vector also indicates a changed scope.