CVE-2026-110084
7.1HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-91
Impact
Authenticated low-privileged attackers can bypass security controls over the network to read unauthorized data and perform limited writes. They only need standard low-level user access and network reachability to the application.
Root cause
Improper input sanitization allows blind XPath/XML injection in query processing.
Affected systems
Adobe Experience Manager (specific vulnerable versions not listed in the advisory summary — check the vendor bulletin).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Fix & remediation
Apply the security patch referenced in vendor bulletin APSB26-152; if unable to patch immediately, restrict network access to low-privileged user interfaces or audit and restrict permissions for unneeded accounts.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.