CVE-2026-48261 describes a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. The issue arises from improper handling of the DOM environment, enabling an attacker to execute arbitrary JavaScript code within the victim's browser context after the victim visits a maliciously crafted webpage. The vulnerability requires user interaction and changes the security scope. The CVSS v3.1 base score is 5.4, reflecting medium severity with network attack vector, low attack complexity, required privileges, and user interaction. No official remediation or patch information is provided in the available data.

Successful exploitation could lead to limited confidentiality and integrity impacts by executing arbitrary JavaScript in the victim's browser, potentially allowing theft of sensitive information or manipulation of the user interface. There is no impact on availability. The attack requires user interaction and privileges, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe whether the vulnerability has been mitigated server-side. Until an official fix or mitigation is confirmed, limit exposure by educating users about the risks of visiting untrusted links and monitoring for suspicious activity related to Adobe Experience Manager.