CVE-2026-110081: Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs low-privileged access to inject malicious script into a vulnerable form field. Exploitation also requires a victim to browse to the page containing that field.
What is the likely impact on affected users?
Malicious JavaScript can execute in the victim's browser. The listed scope change and low confidentiality and integrity impacts indicate the attack may affect resources beyond the vulnerable component's original security scope.
Is this exploitable without user interaction?
No. The attack requires user interaction because a victim must browse to a page that contains the stored malicious content.