What is the CVSS score of CVE-2026-48301?

CVE-2026-48301 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-48301

EUVD-2026-35606 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-7xch-f2rq-c228

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:06 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored XSS in Adobe Experience Manager (AEM) versions up to 2026.04 allows a low-privileged authenticated attacker to persist malicious JavaScript in vulnerable form fields, which executes in any victim's browser upon visiting the affected page. The CVSS S:C (Scope Changed) flag elevates the practical risk: a low-privileged content author could target administrators browsing the same AEM instance, enabling session hijacking or privilege escalation beyond the raw 5.4 Medium score implies. No public exploit identified at time of analysis; Adobe has published advisory APSB26-56 addressing the issue.

Technical ContextAI

Adobe Experience Manager is an enterprise content management platform used for authoring, managing, and delivering digital content at scale. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), specifically the stored variant: attacker-controlled input is persisted server-side in the AEM content repository and later rendered without sufficient output encoding in victim browsers. The CVSS vector S:C (Scope Changed) is technically significant - the injected script executes within the victim browser's security context (a different scope than the AEM authoring environment), allowing the payload to access cookies, localStorage, and perform authenticated HTTP requests on behalf of the victim. EUVD-2026-35606 confirms affected versions span the full AEM product line at or below 2026.04, covering both AEM as a Cloud Service (2026.04 release train) and the on-premises AEM 6.5 Long Term Support branch (up to 6.5.24 and LTS SP1).

RemediationAI

Apply the patches documented in Adobe Security Bulletin APSB26-56 at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html - exact patched version numbers (specific AEM service pack or cloud release) are not independently confirmed from the available intelligence and must be obtained directly from the advisory. As a compensating control pending patching, restrict the AEM content authoring role to the minimum set of trusted users, since exploitation requires a low-privileged authenticated account; this reduces the attacker population but does not eliminate the vulnerability. Deploying a WAF with XSS detection rules on AEM authoring and publishing endpoints can intercept common injection patterns, though WAF bypass is feasible and this is not a substitute for patching. For on-premises deployments, audit AEM Sling-based form components and rich-text editor (RTE) configurations for missing output encoding or overly permissive HTML allowlists, and consider enabling AEM's built-in XSS protection filters (AntiSamy/XSSAPI) on all user-supplied content rendering paths. Note that restricting authoring access may impact content workflow velocity.