What is the CVSS score of CVE-2026-48304?

CVE-2026-48304 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Adobe Experience Manager CVE-2026-48304

EUVD-2026-35602 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 psirt@adobe.com

GHSA-hqfm-8529-ffc3

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:06 vuln.today

DescriptionCVE.org

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored XSS in Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, and 2026.04 and earlier allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any user - including higher-privileged administrators - browses a page containing the injected field, the script executes in their browser under the AEM origin, with scope change (S:C per CVSS) enabling impact beyond the authoring component itself. No public exploit code or active exploitation has been identified at time of analysis; however, the persistent nature of the injection and AEM's typical enterprise deployment profile (admin, author, and reviewer roles sharing the same domain) elevate practical risk above what the medium CVSS score alone suggests.

Technical ContextAI

Adobe Experience Manager is an enterprise content management system widely used for web authoring, digital asset management, and form creation. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): AEM fails to adequately sanitize attacker-controlled input before storing it in the content repository and subsequently rendering it to other users' browsers. The CVSS scope change flag (S:C) is technically significant - it confirms that the injected script executes under the AEM application's browser origin, crossing the security boundary and potentially accessing cookies, local storage, or DOM state of the victim's authenticated AEM session. Affected versions per ENISA EUVD-2026-35602 span all AEM releases through 2026.04, covering both the legacy 6.5.x service pack branch and the cloud-native LTS and rolling release tracks. No CPE strings were provided in the input data.

RemediationAI

Apply the fix documented in Adobe Security Bulletin APSB26-56, available at https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html. The bulletin covers all three affected AEM release tracks (6.5.x, LTS, and cloud rolling); administrators must consult the advisory directly to identify the exact patched service pack or build number for their deployed branch, as the input data does not specify a precise fixed version. Patch availability is confirmed per vendor advisory (APSB26-56), but exact fix version numbers per branch are not independently verified from the provided data - treat the advisory as authoritative. As a compensating control prior to patching, restrict AEM author permissions so that only the minimum necessary set of trusted users can edit form fields, using AEM's built-in ACL and permission model - this directly limits the pool of principals who can inject payloads, though it may impact legitimate content authoring workflows. Additionally, if the AEM author environment is not required to be publicly internet-facing, network-layer restrictions (firewall rules, VPN gating) can reduce the attacker's ability to reach the authoring interface at all, limiting exploitation to internal or authenticated network paths only.