What is the CVSS score of CVE-2026-48265?

CVE-2026-48265 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-48265

EUVD-2026-35715 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-9x64-6fjw-77wx

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:11 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

AnalysisAI

DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) versions up to and including 6.5.24, LTS SP1, and 2026.04 allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by inducing them to visit a crafted webpage. The changed scope (S:C in the CVSS vector) indicates the injected script escapes the AEM application boundary and executes in the victim's browser context, enabling session hijacking, credential harvesting, or further client-side attacks. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Adobe Experience Manager is an enterprise content management platform used for web content, digital assets, and forms. DOM-based XSS (CWE-79) differs from reflected or stored XSS in that the malicious payload never reaches the server - instead, client-side JavaScript reads attacker-controlled data from the DOM (e.g., URL fragment, query parameter, or document.referrer) and writes it unsanitized into an executable context such as innerHTML or eval(). The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C reflects a network-accessible, low-complexity attack requiring a low-privileged AEM session and victim interaction, with scope change indicating cross-origin or cross-component browser impact. The affected CPE range covers AEM ≤ 2026.04 per EUVD-2026-35715.

RemediationAI

Apply the fix documented in Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The exact patched version numbers are not independently confirmed from the available input data beyond the advisory reference - consult APSB26-56 directly for the specific 6.5.x Service Pack or cloud release that resolves this issue. Patch status is confirmed per vendor advisory. As a compensating control prior to patching, restrict access to AEM Author environments to trusted internal networks or VPN only, reducing the attacker's ability to deliver a crafted link to authenticated users. Content Security Policy (CSP) headers can reduce DOM XSS impact by blocking inline script execution, but implementing CSP on AEM without testing may break authoring UI components - evaluate carefully. User awareness for not clicking unsolicited links while authenticated to AEM provides marginal but meaningful risk reduction.