CVE-2026-110082: Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)
Published Oct 13, 2026
·Updated
Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.
Affected Software
3 affected components
Adobe Adobe Experience Manager
Adobe Experience Manager<=6.5
Adobe Experience Manager<=6.5.25.0
Event History
Oct 13, 2026
CVE Published
12:00 AM
Data Sourced
12:00 AM
SeverityWeaknessAffected Software
CVE Published
via MITRE·07:38 PM
Data Sourced
via MITRE·07:38 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeaknessAffected Software
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-90532
- CVE-2026-48383
- CVE-2026-48382
- CVE-2026-105895
- CVE-2026-103848
- CVE-2026-75732
- CVE-2026-90531
- CVE-2026-83662
- CVE-2026-106630
- CVE-2026-106629
- CVE-2026-106626
- CVE-2026-106634
- CVE-2026-110083
- CVE-2026-110084
- CVE-2026-83958
- CVE-2026-83960
- CVE-2026-106628
- CVE-2026-110080
- CVE-2026-110079
- CVE-2026-110078
- CVE-2026-110077
- CVE-2026-110076
- CVE-2026-110081
- CVE-2026-110075
- CVE-2026-110074
- CVE-2026-107682
- CVE-2026-110073
- CVE-2026-110037
- CVE-2026-109415
- CVE-2026-106631
- CVE-2026-107305
- CVE-2026-106633
- CVE-2026-106632
- CVE-2026-48398
Frequently Asked Questions
1
Is anonymous exploitation indicated?
No. The available information states that the attacker must have low-privileged access.
2
Does exploitation require a victim to take action?
Yes. The attacker must convince a victim to visit a URL that references a vulnerable page for malicious JavaScript to execute in the victim's browser context.