CVE-2026-106628: Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Description

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 8% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

AE

Adobe Experience Manager 6.5 · Adobe

through 6.5.25 · source: vendor

AE

Adobe Experience Manager 6.5 LTS · Adobe

through 6.5 LTS SP3 · source: vendor

EM

Experience Manager · Adobe

through 6.5; through 6.5.25.0; through 2026.9.28187 · source: NVD