Adobe Experience Manager CVE-2026-110084

Exploitation requires an authenticated low-privileged account on an Adobe Experience Manager 6.5 instance (versions 6.5.0 through 6.5.25) that is network-reachable, per the CVSS vector (AV:N/PR:L/UI:N). The attacker must reach a feature that passes attacker-controlled input into an XPath/XML query without sufficient sanitization; no user interaction or elevated privileges are needed. The primary limiting factor is the PR:L requirement - the attacker must first obtain valid low-privileged credentials or a session, so purely external unauthenticated attackers cannot exploit this directly; impact is further bounded to unauthorized reads and only limited writes (I:L), with no availability impact (A:N).

The CVSS 3.1 base score of 7.1 (vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) describes a network-reachable, low-complexity flaw requiring low privileges and no user interaction, with high confidentiality impact, low integrity impact, and no availability impact - consistent with the description of a Blind XPath/XML Injection enabling a security feature bypass yielding unauthorized read and limited write access. The PR:L metric means an attacker must already hold a low-privileged account, which meaningfully lowers real-world risk versus a fully unauthenticated flaw and points toward insider or post-foothold abuse rather than mass opportunistic scanning. No EPSS score, SSVC decision, KEV listing, or POC was supplied in the input, so exploitation likelihood cannot be quantified; there is no public exploit identified at time of analysis and no evidence of active exploitation. The 'Authentication Bypass' tag is slightly imprecise - the vendor and NVD characterize this as a security-feature bypass via XPath injection by an already-authenticated low-privileged user, not a pre-auth authentication bypass; treat the tag as a loose label rather than confirmation of unauthenticated access. Net: a genuine but not top-tier priority - a real high-severity issue gated behind existing low-privilege access, warranting prompt patching on internet-facing AEM instances but not emergency zero-day handling absent exploitation signals.

An attacker who already possesses a low-privileged Adobe Experience Manager account submits crafted input that is unsafely incorporated into an XPath query, inferring protected data through blind true/false response differences and bypassing an intended security control. No user interaction is needed, and the flaw is reachable over the network, letting the attacker read unauthorized content and make limited unauthorized writes. No public exploit code has been identified, so exploitation would currently require independent development.