CVE-2026-48257 is a DOM-based Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this issue by manipulating the Document Object Model (DOM) environment to execute arbitrary JavaScript code within the victim's browser. The attack requires the victim to interact by visiting a maliciously crafted webpage. The vulnerability affects the confidentiality and integrity of data but does not impact availability. The scope of the vulnerability is changed, indicating that the vulnerability affects resources beyond the initially vulnerable component.

Successful exploitation could lead to the execution of malicious scripts in the context of the victim's browser, potentially allowing theft of sensitive information or session tokens, and manipulation of web content. The impact is limited to confidentiality and integrity with no direct availability impact. User interaction is required for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if the vulnerability has been mitigated server-side. Until an official fix or mitigation is confirmed, avoid visiting untrusted or suspicious links and ensure that users are aware of the risk of interacting with unknown webpages.