CVE-2026-48299 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. When a victim accesses the page containing the injected script, the malicious code executes in their browser, potentially impacting confidentiality and integrity. The vulnerability scope is changed, indicating that the impact may extend beyond the initially affected component. No official patch or remediation level has been provided yet, and no known exploits are reported in the wild.

Successful exploitation allows an attacker with low privileges to execute arbitrary JavaScript in the context of the victim's browser session when visiting the affected page. This can lead to partial confidentiality and integrity loss, such as theft of sensitive information or manipulation of page content. Availability is not impacted. The vulnerability affects the security boundary of the web application by enabling script injection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to vulnerable form fields and applying input validation or output encoding as temporary mitigations. Monitor Adobe's advisories for updates on patches or official workarounds.