What is the CVSS score of CVE-2026-48268?

CVE-2026-48268 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-48268

EUVD-2026-35632 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-v29r-3c9p-vwmc

XSS Adobe

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:10 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

AnalysisAI

DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, and 2026.04 and earlier allows a low-privileged, authenticated attacker to execute malicious JavaScript within a victim's browser by manipulating the DOM environment of a crafted webpage. The CVSS Scope:Changed indicator confirms this vulnerability crosses the security boundary from the AEM application into the victim's browser context, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Adobe has published advisory APSB26-56 acknowledging the issue.

Technical ContextAI

Adobe Experience Manager (AEM) is an enterprise content management platform. CWE-79 (Improper Neutralization of Input During Web Page Generation) in its DOM-based variant means attacker-controlled data flows into a sink - such as innerHTML, document.write, or eval - via client-side JavaScript without adequate sanitization, rather than through server-rendered HTML. The EUVD record EUVD-2026-35632 and NVD reference both corroborate the affected version range as all AEM releases up to and including 6.5.24 (traditional branch), LTS SP1, and cloud-native 2026.04. The S:C (Scope Changed) component of the CVSS vector is consistent with DOM XSS behavior: the vulnerability originates in the AEM application context but the injected script executes within the victim's browser security context, crossing the application/browser trust boundary.

RemediationAI

The primary remediation is to apply the patch or upgrade described in Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The exact patched release version is not independently confirmed from the data provided beyond the advisory reference - consult APSB26-56 directly for the specific target version. For organizations unable to patch immediately, compensating controls should focus on reducing the attack surface for phishing delivery: enforce strict Content Security Policy (CSP) headers on AEM-served pages to block inline script execution and restrict script sources, which would directly limit DOM XSS impact. Additionally, restrict the population of low-privileged AEM authenticated users who receive untrusted external links, and consider enforcing anti-CSRF tokens on sensitive AEM author actions to limit what an XSS payload can accomplish on behalf of a hijacked session. Note that CSP alone does not eliminate the vulnerability but meaningfully reduces exploitability if inline scripts are blocked.