What is the CVSS score of CVE-2026-48250?

CVE-2026-48250 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-48250

EUVD-2026-35713 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-j3wc-4jg4-6ch4

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:14 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

AnalysisAI

DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, and 2026.04 and earlier allows a low-privileged authenticated attacker to execute arbitrary JavaScript within a victim's browser by manipulating the client-side DOM environment. The CVSS scope change (S:C) is a notable signal - injected script executes outside the attacker's own security context, enabling session hijacking or privilege escalation against higher-privileged users such as AEM administrators. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Technical ContextAI

DOM-based XSS (CWE-79) differs from reflected or stored XSS in that the malicious payload is processed entirely by client-side JavaScript - the vulnerable code reads attacker-controlled data from the DOM (e.g., URL fragment, document.referrer, window.name) and writes it back to the page without sanitization, bypassing server-side output encoding controls. AEM is Adobe's enterprise content management system built on Apache Sling and OSGi, heavily reliant on client-side JavaScript for its authoring UI and dynamic content delivery. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C confirms network delivery, low exploitation complexity, an authenticated attacker, mandatory victim interaction, and cross-boundary impact. The EUVD-2026-35713 listing corroborates the affected version ceiling as AEM ≤ 2026.04 across both the legacy 6.5.x LTS track and the cloud-native 2026.x release track.

RemediationAI

Apply the fixes described in Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html, which addresses both the 6.5.x LTS and 2026.x cloud release tracks. An exact patched version number is not independently confirmed from the provided input data beyond what the APSB26-56 advisory specifies - consult the bulletin directly for target upgrade versions. If immediate patching is not feasible, restrict AEM author environment access to trusted internal networks or VPN only, reducing the attacker's ability to deliver the crafted payload to victims; note this does not eliminate risk if internal accounts are already compromised. Content Security Policy (CSP) headers configured to block inline script execution and restrict script sources to trusted origins provide a meaningful client-side defense against DOM XSS, though AEM's rich authoring UI may require careful CSP tuning to avoid breaking legitimate functionality. WAF rules targeting DOM-manipulation patterns offer limited protection since DOM XSS payload processing occurs in the browser, not on the server.