CVE-2026-48266 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker can exploit this by manipulating the DOM environment to execute arbitrary JavaScript code within the victim's browser context. Exploitation requires user interaction via a crafted webpage visit. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity) with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts confidentiality and integrity with changed scope.

Successful exploitation allows an attacker to execute malicious scripts in the victim's browser, potentially leading to unauthorized disclosure and modification of information within the affected application context. There is no impact on availability. The changed scope indicates that the vulnerability may affect components beyond the initially vulnerable module.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor Adobe's security advisories for updates. Until a patch is available, limit exposure by educating users to avoid clicking on untrusted links and consider applying any recommended temporary mitigations from Adobe if published.