What is the CVSS score of CVE-2026-48280?

CVE-2026-48280 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-48280

EUVD-2026-35640 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-8hvc-rjx3-fpx6

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:09 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

AnalysisAI

DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) versions up to and including 6.5.24, LTS SP1, and 2026.04 allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by manipulating the DOM environment through a crafted webpage. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable AEM component itself - for instance, to other browser-accessible resources or session contexts. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires deliberate social engineering to induce user interaction.

Technical ContextAI

Adobe Experience Manager is an enterprise-grade CMS and digital experience platform used for web content management. DOM-based XSS (CWE-79) is distinct from reflected or stored XSS: the payload is never sent to or processed by the server. Instead, client-side JavaScript in AEM reads attacker-controlled data from the DOM (e.g., URL fragment, document.location, or query parameters) and writes it into the page without sanitization, causing the browser to execute the injected script. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C indicates: remote network delivery, low attack complexity, a low-privilege account is required on the attacker's side, victim interaction is mandatory, and the vulnerability crosses a security boundary (scope change). EUVD-2026-35640 tracks this in the EU vulnerability database. Affected CPE is inferred as Adobe Experience Manager versions 0 through 2026.04 per EUVD data.

RemediationAI

The primary fix is to apply the update documented in Adobe security bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. An exact fixed version number was not present in the provided input data - verify the specific target release against that advisory before patching. As a compensating control while patching, restrict the creation and modification of content or pages by untrusted or lower-privilege AEM author accounts, since the attack requires a low-privileged authenticated attacker to craft or influence a page or URL that a higher-privileged user will visit. Enforcing strict role-based access controls and limiting who can publish or link content reduces exposure. Additionally, deploying a Content Security Policy (CSP) header on AEM-served pages that disallows inline script execution and restricts script sources can significantly mitigate DOM XSS impact; however, configuring CSP on complex CMS environments may break legitimate page functionality and requires testing. User awareness around not clicking untrusted AEM links from colleagues is a low-cost supplementary control.