CVE-2026-110084: Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)
Published Oct 13, 2026
·Updated
Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.
Affected Software
2 affected components
Adobe Adobe Experience Manager
Adobe Experience Manager<=6.5.25.0
Event History
Oct 13, 2026
CVE Published
12:00 AM
Data Sourced
12:00 AM
SeverityWeaknessAffected Software
CVE Published
via MITRE·07:38 PM
Data Sourced
via MITRE·07:38 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeaknessAffected Software
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-90532
- CVE-2026-48383
- CVE-2026-48382
- CVE-2026-105895
- CVE-2026-103848
- CVE-2026-75732
- CVE-2026-90531
- CVE-2026-83662
- CVE-2026-106630
- CVE-2026-106629
- CVE-2026-106626
- CVE-2026-106634
- CVE-2026-110083
- CVE-2026-83958
- CVE-2026-83960
- CVE-2026-106628
- CVE-2026-110080
- CVE-2026-110079
- CVE-2026-110078
- CVE-2026-110077
- CVE-2026-110076
- CVE-2026-110081
- CVE-2026-110075
- CVE-2026-110074
- CVE-2026-107682
- CVE-2026-110073
- CVE-2026-110037
- CVE-2026-109415
- CVE-2026-106631
- CVE-2026-110082
- CVE-2026-107305
- CVE-2026-106633
- CVE-2026-106632
- CVE-2026-48398
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker needs low-privileged access. Exploitation does not require user interaction.
2
What could a successful exploit allow?
An attacker could bypass security measures and obtain unauthorized read access along with limited write access.