---
cve: "CVE-2026-110084"
severity: "HIGH"
cvss: 7.1
epss: "0.5%"
vendor: "Adobe"
kev: false
exploited: false
published: "2026-10-13 20:17:27"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-11-10T19:26:26+01:00"
---

# CVE-2026-110084

> 7.1 HIGH

## Beschreibung

Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.

## CNA-Record (Kanon, cvelistV5)

- CNA: **adobe**
- State: PUBLISHED
- Stand: 2026-10-14 16:41:39
- CNA-CVSS: **7.1** (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Gering | warn |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-91** — XML Injection
  The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

## Angriffsmuster (CAPEC)

- [CAPEC-83 — XPath Injection](https://capec.mitre.org/data/definitions/83.html) _(Severity: High)_
- [CAPEC-250 — XML Injection](https://capec.mitre.org/data/definitions/250.html)

## BSI-Hinweise (deutsch)

- [Adobe Experience Manager: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-3926) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen in Adobe Experience Manager ausnutzen, um Privilegien zu eskalieren, beliebigen Programmcode auszuführen, oder Sicherheitsvorkehrungen zu umgehen.

## Referenzen

- <https://helpx.adobe.com/security/products/experience-manager/apsb26-152.html>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-110084/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_