CVE-2026-48253

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

View on CVE.org
Published Jul 14, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Description
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

Analysis

AI-generated

Technical impact

Adobe Experience Manager is affected by a DOM‑based Cross‑Site Scripting flaw that allows an attacker to manipulate the DOM environment and execute malicious JavaScript within the victim’s browser. The vulnerability requires the victim to visit a specially crafted webpage, after which browser‑side code runs in the user’s context.

Affected Systems

Adobe Experience Manager versions 6.5, 6.5 LTS, and Adobe Experience Manager as a Cloud Service are affected. No specific patch or fixed version information is listed in the advisory.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity, while an EPSS score of less than 1% shows the exploit likelihood is low. The vulnerability is not listed in the CISA KEV catalog. Because the flaw requires the victim to voluntarily visit a crafted URL, the attack vector is user‑directed, which limits the rapidity of widespread exploitation.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Adobe Experience Manager update that addresses the DOM‑based XSS vulnerability as detailed in Adobe’s security bulletin.
  • Configure a Content‑Security‑Policy that disallows inline scripts and restricts script sources to mitigate DOM‑based XSS until a patch is installed.
  • Review and sanitize any user‑provided URLs or parameters that are rendered into the DOM to prevent script injection.

Generated by OpenCVE AI on July 31, 2026 at 05:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Adobe
Adobe adobe Experience Manager
Adobe experience Manager Cloud Service
Vendors & Products Adobe
Adobe adobe Experience Manager
Adobe experience Manager Cloud Service
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Title Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
adobe
Published
Updated
Aug 27, 2026, 10:39 PM
Reserved
May 21, 2026, 3:28 PM

View source JSON

Updated
Jul 15, 2026, 1:54 PM

JSON

Status
Analyzed
Published
Jul 14, 2026, 8:17 PM
Modified
Aug 28, 2026, 12:17 AM

View source JSON

No data.

Updated
Aug 5, 2026, 10:15 AM

JSON