What is the CVSS score of CVE-2026-48297?

CVE-2026-48297 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-48297

EUVD-2026-35634 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-24rj-crvf-pj7r

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:08 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager versions 6.5.24, LTS SP1, and 2026.04 and earlier enables an authenticated low-privileged attacker - such as a content editor - to persist malicious JavaScript payloads into vulnerable form fields. The injected script executes in the browser of any victim who subsequently browses to the affected page, with scope change (S:C) indicating the attack crosses from the author context into the victim's browser security context. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.

Technical ContextAI

Adobe Experience Manager (AEM) is an enterprise content management platform used for web, mobile, and digital asset management. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-supplied input is stored without adequate sanitization and later rendered in page output without proper encoding, allowing script injection. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C is textbook stored XSS - network-accessible, low complexity to exploit, requires only low-privileged credentials to inject, but requires a distinct victim to trigger execution. The scope change component specifically reflects that the attacker's context (content authoring) differs from the execution context (victim's browser), which is the defining characteristic of XSS crossing trust boundaries. Affected versions span both the classic on-premises branch (≤6.5.24, LTS SP1) and the cloud/managed-service release line (≤2026.04), indicating the flaw exists across AEM deployment models.

RemediationAI

Apply the update detailed in Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html, which addresses both the 6.5.x on-premises branch and the 2026.04 cloud service release line. No exact fixed version number was independently confirmed from the available data - administrators must consult APSB26-56 directly for precise Service Pack or release identifiers. As a compensating control pending patch deployment, restrict write access to AEM form fields and content authoring interfaces to the minimum necessary set of trusted users, reducing the pool of potential attackers; note this may impede legitimate authoring workflows. Deploying a Web Application Firewall rule to intercept and reject common XSS payload patterns in POST requests to AEM form submission endpoints can reduce risk, though WAF rules carry a false-positive risk for legitimate rich-text content containing angle brackets or JavaScript-adjacent strings. Content Security Policy (CSP) headers configured to disallow inline scripts can limit the blast radius of any successful injection.