Adobe Experience Manager CVE-2026-110082

Exploitation requires the attacker to hold a low-privileged authenticated account on the AEM instance (CVSS PR:L) AND to successfully social-engineer a victim into visiting an attacker-crafted URL that references the vulnerable page (CVSS UI:R) - both conditions must be met, which materially limits opportunistic or automated attacks. The affected feature is a specific AEM page/endpoint that reflects user-supplied input into the response without adequate output encoding; the Adobe advisory (APSB26-152) does not name the exact component in the provided data. Affected deployments are AEM 6.5 LTS up to and including SP3 and AEM 6.5 up to and including 6.5.25; patched/later versions are not vulnerable. The scope-changed nature means impact lands in the victim's browser session (AEM origin) rather than directly on the server.

This is a moderate-severity reflected XSS (CWE-79) with a vendor-assigned CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The signals are internally consistent and point to a genuine-but-not-urgent issue rather than a top-priority emergency: the network attack vector and low complexity ease delivery, but exploitation is gated by two meaningful limiters - the attacker needs low-privileged authentication (PR:L) to the AEM instance, and the victim must be convinced to click a crafted URL (UI:R). The scope-changed flag (S:C) plus only Low confidentiality/integrity and no availability impact reflect that code executes in the victim's browser context rather than compromising the server directly. No EPSS score, CISA KEV entry, POC, or SSVC decision data was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - real-world risk should be treated as modest. The PR:L requirement is a notable constraint: an attacker already needs some authenticated foothold, which argues against widespread opportunistic exploitation. EPSS and KEV status are both MISSING from the input and cannot be assumed; prioritize patching for internet-exposed authoring/publish instances but this does not warrant out-of-band emergency response on these signals alone.

A low-privileged authenticated user crafts a URL pointing to a vulnerable AEM page that reflects attacker-controlled input without proper encoding, embedding malicious JavaScript. The attacker then lures a higher-value victim (e.g., an AEM author or administrator) into clicking the link, and the script executes in the victim's browser session under the AEM origin, enabling session/token theft or actions on the victim's behalf. No public exploit code was identified in the provided intelligence.