CVE-2026-48260 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this issue by manipulating the Document Object Model (DOM) environment, causing malicious JavaScript to execute within the victim's browser. This attack requires the victim to interact by visiting a specially crafted webpage. The vulnerability affects the confidentiality and integrity of data but does not impact availability. The scope of the vulnerability is changed, indicating that the vulnerability affects components beyond the initially vulnerable component.

Successful exploitation could lead to the execution of arbitrary JavaScript in the context of the victim's browser, potentially allowing an attacker to steal sensitive information or perform actions on behalf of the user. The impact is limited to confidentiality and integrity with no direct availability impact. Exploitation requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe whether remediation is managed server-side. Until an official fix or mitigation is provided, users should exercise caution when interacting with untrusted links or webpages.