What is the CVSS score of CVE-2026-48264?

CVE-2026-48264 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-48264

EUVD-2026-35605 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-h3jc-v8xg-f37x

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:12 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

AnalysisAI

DOM-based Cross-Site Scripting in Adobe Experience Manager (versions 6.5.24, LTS SP1, and 2026.04 and earlier) allows a low-privileged authenticated attacker to inject and execute malicious JavaScript in a victim's browser by manipulating client-side DOM sinks. The CVSS scope-changed flag (S:C) indicates the injected script can operate beyond the vulnerable component's security context, enabling session theft, credential harvesting, or unauthorized administrative actions against higher-privileged users within the same AEM instance. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, but the cross-privilege escalation potential in shared AEM deployments warrants prompt patching.

Technical ContextAI

Adobe Experience Manager (AEM) is a Java-based enterprise content management and digital experience platform widely deployed in large organizations for web publishing, digital asset management, and marketing workflows. DOM-based XSS (CWE-79: Improper Neutralization of Input During Web Page Generation) occurs when client-side JavaScript reads attacker-controlled data from an untrusted DOM source - such as the URL fragment, document.referrer, or window.name - and writes it to the page via an unsafe sink (e.g., innerHTML, document.write) without sanitization. Unlike reflected or stored XSS, the malicious payload never reaches the server, rendering server-side output encoding ineffective as a sole mitigation. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C confirms the flaw is network-reachable with low complexity, requires a low-privilege AEM account, demands victim interaction, and crosses security boundaries - consistent with a client-side flaw in AEM's authoring or preview interface that can be triggered against any co-resident user.

RemediationAI

Apply the patch documented in Adobe Security Bulletin APSB26-56, available at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The exact remediated version number was not included in the provided input data and must be confirmed directly from APSB26-56 before deployment - do not infer a fix version from this analysis. Organizations running AEM as a Cloud Service should verify whether Adobe's automated patching pipeline has already applied the fix for the 2026.x release line. As interim compensating controls: (1) Restrict AEM authoring-environment access to the minimum set of fully vetted, trusted users, since PR:L authentication is a prerequisite - reducing the authenticated user population directly shrinks the attack surface, with the trade-off of limiting self-service content workflows; (2) Deploy or harden Content Security Policy (CSP) headers on AEM-served pages to restrict inline script execution and limit DOM-based XSS impact, noting that CSP changes require regression testing against AEM's JavaScript-heavy authoring UI to avoid breaking legitimate functionality; (3) For AEM 6.5.x on-premises, ensure Service Pack patching pipelines are current and monitor the AEM Security Checklist for additional hardening guidance.