CVE-2026-48258 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker can exploit this by manipulating the Document Object Model (DOM) environment to execute arbitrary JavaScript code within the victim's browser context. This requires the victim to interact by visiting a maliciously crafted webpage. The vulnerability changes the security scope and impacts confidentiality and integrity of the affected system. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and partial confidentiality and integrity impact. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to partial confidentiality and integrity compromise of user data within the affected Adobe Experience Manager environment. Availability is not impacted. The attack requires user interaction (visiting a crafted webpage).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted content and consider implementing web application firewall rules or other controls to detect and block malicious payloads targeting this vulnerability.