CVE-2026-48266

Summary

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

Affected Software

VendorProductVersion RangeStatus
AdobeAdobe Experience Manager as a Cloud Service0 <= 2026.4.0affected
AdobeAdobe Experience Manager as a Cloud Service2026.5.0unaffected
AdobeAdobe Experience Manager 6.5 LTS0 <= SP1affected
AdobeAdobe Experience Manager 6.5 LTSSP2unaffected
AdobeAdobe Experience Manager 6.50 <= 6.5.24affected
AdobeAdobe Experience Manager 6.56.5.25unaffected

Weaknesses

  • CWE-79: Cross-site Scripting (DOM-based XSS) (CWE-79)

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References