CVE-2026-48263 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. It enables an attacker with low privileges to inject malicious JavaScript into form fields that are not properly sanitized. When other users access the affected pages, the injected scripts execute in their browsers, potentially compromising confidentiality and integrity. The vulnerability has a CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). No official remediation or patch has been announced, and no affected versions are specified. The vulnerability scope is changed, indicating that the impact crosses security boundaries.

An attacker with low privileges can inject malicious scripts into vulnerable form fields, which execute in the browsers of users who visit the affected pages. This can lead to partial loss of confidentiality and integrity of user data or session information. There is no impact on availability. The vulnerability affects the security scope, potentially allowing attackers to escalate privileges or access data beyond their initial permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, monitor Adobe's official security advisories for updates. Until a fix is available, consider restricting access to vulnerable form fields or applying input validation and output encoding where possible. Avoid relying on client-side mitigations alone.