CVE-2026-48300 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker with low privileges can inject malicious JavaScript into vulnerable form fields. When a victim views the page containing the injected script, the malicious code executes in their browser, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity) with network attack vector, low attack complexity, low privileges required, and user interaction needed. The scope is changed, indicating impact beyond the vulnerable component. No known exploits in the wild or vendor remediation details are currently available.

Successful exploitation allows an attacker with low privileges to execute arbitrary JavaScript in the context of users visiting the affected pages. This can lead to information disclosure and limited integrity impacts. There is no direct impact on availability. The vulnerability requires user interaction and affects confidentiality and integrity within the changed scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to vulnerable form fields and applying input validation or output encoding as temporary mitigations. Monitor Adobe's security advisories for updates.