CVE-2026-48297 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. A low-privileged attacker can exploit vulnerable form fields to inject malicious JavaScript, which executes in the context of users visiting the affected pages. This can lead to partial compromise of confidentiality and integrity of user data. The vulnerability has a CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). No official patch or remediation level has been published yet, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with low privileges to inject and execute malicious scripts in the browsers of users who visit the affected pages. This can lead to partial disclosure of confidential information and integrity violations, such as session hijacking or unauthorized actions performed on behalf of the user. There is no impact on availability. The vulnerability scope is changed, indicating that the attack affects resources beyond the attacker’s privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to vulnerable form fields and applying input validation or output encoding as temporary mitigations. Monitor Adobe's security advisories for updates and apply patches promptly once available.