CVE-2026-48255 describes a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. The issue arises from improper handling of DOM elements, enabling an attacker to inject and execute malicious scripts within the victim's browser context. Exploitation requires the victim to interact with a maliciously crafted webpage. The vulnerability impacts confidentiality and integrity with limited scope and no availability impact. No official remediation or patch information is currently available, and the vendor has not indicated a remediation level.

Successful exploitation could lead to execution of arbitrary JavaScript in the victim's browser, potentially allowing theft of sensitive information or session tokens, and manipulation of web content. The impact affects confidentiality and integrity but does not affect availability. User interaction is required for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe whether server-side patches or mitigations have been applied. Until official fixes are available, users should exercise caution when interacting with untrusted or suspicious links.