Adobe Experience Manager CVE-2026-48255

Exploitation requires the attacker to possess a valid low-privileged account on the target AEM instance, as confirmed by CVSS PR:L - unauthenticated external attackers cannot exploit this vulnerability directly. The victim must be an authenticated AEM user who actively clicks a crafted link or visits a crafted webpage while logged in, satisfying the mandatory user interaction requirement (CVSS UI:R); passive page visits or cached content do not trigger the vulnerability. Because the flaw is DOM-based, the malicious payload is processed entirely client-side by the victim's browser, meaning server-side filtering and WAF rules targeting reflected XSS patterns may not intercept it. Limiting factors include: the attacker must hold an AEM account (narrowing the threat actor pool to insiders or compromised credential holders), the attack requires explicit victim action (precluding automation per SSVC), and no special non-default AEM configuration is required beyond standard authenticated access to the affected product versions.

The vendor-reported CVSS 3.1 score of 5.4 (Medium) is internally consistent: AV:N reflects URL-based delivery, AC:L indicates no special conditions are required, PR:L confirms a low-privileged AEM account is needed, UI:R mandates victim interaction, S:C captures the browser scope change, and C:L/I:L/A:N reflect partial session/content impact with no availability consequence. Real-world risk is materially moderated: the PR:L requirement means unauthenticated outsiders cannot exploit this directly - an attacker must already hold an AEM account, which limits the threat actor pool. The mandatory user interaction (UI:R) further requires social engineering. SSVC corroborates a restrained posture: Exploitation status 'none', Automatable 'no', Technical Impact 'partial'. The EPSS probability of 0.27% (19th percentile) confirms low exploitation likelihood in the near term, and the CVE is absent from CISA KEV. No POC code has been identified. This is a legitimate medium-severity finding that fits normal patching cycles rather than emergency response; organizations with internet-exposed AEM author instances or high-value editor accounts should prioritize accordingly.

An attacker with a low-privileged AEM account - such as a contributor or basic user account - constructs a URL that passes a malicious JavaScript payload through a DOM source (e.g., a URL fragment or query parameter) that AEM's client-side code reflects into the DOM unsanitized. The attacker delivers this URL via a phishing email or internal message to a higher-privileged AEM user such as an editor or administrator. When the victim, already authenticated to AEM, visits the crafted link, their browser processes the DOM manipulation and executes the injected JavaScript in the AEM application context, enabling the attacker to steal session tokens, submit unauthorized content changes, or redirect the victim to a credential-harvesting page. No public POC code has been identified at time of analysis.