CVE-2026-48265 is a DOM-based Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager affecting versions up to and including 6.5.24 and 2026.04. An attacker can exploit this by manipulating the DOM environment, causing malicious JavaScript to execute in the context of a victim's browser. Exploitation requires user interaction (visiting a crafted webpage). The vulnerability impacts confidentiality and integrity with a CVSS 3.1 base score of 5.4 (medium severity). No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to unauthorized disclosure or modification of information accessible to the browser session. The vulnerability does not affect system availability. The scope is changed, indicating that the vulnerability impacts resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Adobe's advisories for updates. Until a patch is available, avoid visiting untrusted or suspicious links that could trigger the vulnerability.