CVE-2026-48263 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager as a Cloud Service. It enables a low-privileged attacker to inject malicious scripts into form fields, which are then executed in the browsers of users who view the affected pages. The vulnerability changes the security scope and impacts confidentiality and integrity with no impact on availability. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, and scope change.

Successful exploitation could lead to execution of arbitrary JavaScript in the context of the affected application, potentially compromising user data confidentiality and integrity. There is no indication of availability impact. The vulnerability requires user interaction and low privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe whether the service is managed and patched server-side. Until an official fix is available, consider restricting access to vulnerable form fields or implementing input validation and output encoding as temporary mitigations.