CVE-2026-48254 is a DOM-based Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this issue by manipulating the Document Object Model (DOM) environment, causing malicious JavaScript to execute within the victim's browser. The attack requires user interaction, meaning the victim must visit a specially crafted webpage. The vulnerability affects the confidentiality and integrity of data but does not impact availability. The scope of the vulnerability is changed, indicating that the vulnerability affects resources beyond the initially vulnerable component.

Successful exploitation can lead to the execution of arbitrary JavaScript code in the context of the victim's browser, potentially allowing an attacker to steal sensitive information or perform actions on behalf of the user. The impact is limited to confidentiality and integrity with no direct impact on availability. The vulnerability requires user interaction, which reduces the likelihood of automated exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, the vendor typically manages remediation server-side. Users and administrators should monitor Adobe's official advisories for updates and apply any recommended fixes or mitigations promptly once available.