CVE-2026-48271 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. The vulnerability allows attackers to execute arbitrary JavaScript by manipulating the DOM environment when a victim visits a maliciously crafted webpage. The scope of the vulnerability is changed, indicating that the impact crosses security boundaries. The CVSS 3.1 base score is 5.4, reflecting medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts on confidentiality and integrity but not availability.

Successful exploitation can lead to execution of arbitrary JavaScript in the context of the victim's browser, potentially compromising confidentiality and integrity of user data within the affected application. There is no impact on availability. Exploitation requires user interaction (visiting a crafted webpage). No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Adobe's advisories for updates. Until a patch is available, users should exercise caution with untrusted content and links. No vendor advisory states that no action is required or that the issue is already mitigated.