Advisories · Technology

Adobe Experience Manager 6.5 LTS.

Every CVE that names Adobe Experience Manager 6.5 LTS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-90532 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Adobe Experience Manager | Incorrect Authorization (CWE-863)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-90531 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- XML external entities (XXE)
Not analysed yet 13 Oct 2026
CVE-2026-83960 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-83958 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-83662 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-75732 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Adobe Experience Manager | Incorrect Authorization (CWE-863)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-48383 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Adobe Experience Manager | Incorrect Authorization (CWE-863)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-48382 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Adobe Experience Manager | Incorrect Authorization (CWE-863)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-110082 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-110081 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-110074 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-110037 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-109415 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-106634 CVE record

CVSS 7.7 High

Adobe Experience Manager | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Path traversal
Not analysed yet 13 Oct 2026
CVE-2026-106633 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-106632 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-106631 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-106630 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-106629 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-106628 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-106626 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Adobe Experience Manager | Improper Input Validation (CWE-20)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- CWE-20
Not analysed yet 13 Oct 2026
CVE-2026-103848 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Adobe Experience Manager | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Command injection
Not analysed yet 13 Oct 2026
CVE-2026-84397 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 16 Sept 2026
CVE-2026-71357 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75678 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-71565 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75687 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75672 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75734 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75706 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75730 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75719 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75707 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75690 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75715 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2025-64838 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75646 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75640 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75643 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75726 CVE record

CVSS 3.5 Low

Adobe Experience Manager | Improper Input Validation (CWE-20)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- CWE-20
Not analysed yet 8 Sept 2026
CVE-2026-19612 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75660 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-19479 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75735 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75637 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75705 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75694 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75741 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75679 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2025-64830 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75729 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75685 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75677 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75642 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75671 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75667 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75636 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75644 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75704 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75708 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026