Adobe Experience Manager CVE-2026-48263

Exploitation requires the attacker to hold a valid low-privileged account within the AEM instance with sufficient permissions to submit content to a form field that is rendered without output encoding (PR:L confirmed by CVSS vector). A separate victim user - ideally one with elevated privileges - must actively browse to the page containing the injected field for the payload to execute (UI:R confirmed by CVSS vector). No non-default configuration is required beyond the attacker possessing any authenticated authoring or contributor role. Exploitation is limited by: the need for an authenticated attacker account (ruling out fully external/anonymous attackers), the requirement for victim interaction (no fire-and-forget execution), and the low individual impact per exploitation instance (C:L/I:L). The non-automatable SSVC rating confirms mass scanning and bulk exploitation are not feasible, making this a targeted insider or compromised-credential scenario.

The CVSS base score of 5.4 (Medium) reflects a combination of meaningful access barriers and limited individual impact. The vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N decomposes as follows: network-reachable injection with low complexity, but exploitation requires both a low-privileged account and victim interaction, and impact is limited to low confidentiality and integrity gains. EPSS at 0.29% (21st percentile) corroborates a low near-term exploitation probability - well below the threshold for emergency triage. SSVC further characterizes this as non-automatable with partial technical impact and no known exploitation, consistent with the PR:L/UI:R gating. The changed scope is the primary risk amplifier: a content-author-level attacker could craft a payload that steals session tokens or performs actions as a higher-privileged administrator who reviews content. This makes the vulnerability particularly relevant in AEM environments where content authors are untrusted or external parties. No conflicting signals detected between CVSS, EPSS, and SSVC - all three align on a medium, non-urgent risk profile.

An attacker with a low-privileged AEM content author account submits a crafted payload containing obfuscated JavaScript into a vulnerable form field within the AEM authoring interface, where it is stored persistently in the JCR content repository. When an administrator or higher-privileged user later navigates to the published or preview page containing that field, the malicious script executes in their browser, potentially exfiltrating their session cookie or AEM authentication token to an attacker-controlled server. No public proof-of-concept code is known at time of analysis, but stored XSS exploitation techniques against CMS platforms are well-documented and broadly understood.