CVE-2026-48261

Published: Jul 14, 2026Modified: Jul 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: psirt@adobe.com (Secondary)

Description

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

Affected (5)

Products: Adobe: Experience Manager

Adobe

1 product

Experience Manager

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Adobe Experience Manager	Up to 6.5.25.0
Adobe Experience Manager	Up to 2020.5.0
Adobe Experience Manager	Version 6.5
Adobe Experience Manager	Version 6.5 sp1
Adobe Experience Manager	Version 6.5 sp2

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html

Source: psirt@adobe.com

Vendor Advisory

Timeline

No history available yet.