What is the CVSS score of CVE-2026-48266?

CVE-2026-48266 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-48266

EUVD-2026-35708 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-237c-j3j9-42ww

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:11 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

AnalysisAI

DOM-based XSS in Adobe Experience Manager (AEM) versions up to 6.5.24, LTS SP1, and 2026.04 allows an authenticated low-privileged attacker to inject malicious JavaScript that executes entirely within the victim's browser via client-side DOM manipulation. The changed scope (S:C) in the CVSS vector means successful exploitation can reach session tokens, cookies, or resources beyond the directly vulnerable AEM component - a meaningful risk amplifier in enterprise content authoring environments. Exploitation requires user interaction (UI:R), meaning the attacker must social-engineer a victim into visiting a crafted webpage. No public exploit identified at time of analysis, and CISA KEV listing has not been confirmed.

Technical ContextAI

DOM-based XSS (CWE-79) differs from reflected or stored XSS in that the malicious payload is never processed by the server - it is written directly into the browser's live DOM by vulnerable client-side JavaScript, bypassing server-side input validation entirely. Adobe Experience Manager is a Java-based enterprise CMS built on Apache Sling and OSGi, widely used for large-scale web content authoring and digital asset management. Its rich authoring UI relies heavily on JavaScript frameworks that interact with the DOM, creating a broad surface area for DOM-based injection if unsanitized data flows into sink functions such as innerHTML, document.write, or eval. The CVSS scope change (S:C) reflects the browser-context nature of XSS: once code executes in the victim's browser, it can interact with the AEM session, same-origin resources, and potentially stored credentials. Affected versions span both the on-premise 6.5.x LTS line and the AEM as a Cloud Service (AEMaaCS) 2026.04 release stream per EUVD-2026-35708.

RemediationAI

Apply the fix documented in Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The exact patched Service Pack version for AEM 6.5.x is not independently confirmed in the available intelligence data beyond the advisory reference - consult APSB26-56 directly for the specific cumulative fix package or Service Pack number. AEM as a Cloud Service customers should verify their environment has received the 2026.05 or later automatic update. As a compensating control pending patching, restrict AEM author environment access to internal networks or VPN only, which eliminates the externally reachable attack surface required by the network-vector (AV:N) exploit path - note this does not protect against insider threats holding low-privileged accounts. Deploying a strict Content Security Policy (CSP) on AEM pages can limit JavaScript execution to approved sources and reduce XSS impact, but be aware that AEM's authoring UI relies on inline scripts and may require policy tuning to avoid breaking legitimate authoring functionality.