CVE-2026-48301 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager affecting versions up to 6.5.24 and 2026.04 and earlier. The vulnerability allows a low-privileged attacker to inject malicious JavaScript into form fields, which is then executed in the browsers of users who access the affected pages. This can lead to scope changes and potential compromise of user interactions with the application. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, scope change, and limited confidentiality and integrity impacts.

Successful exploitation enables an attacker with low privileges to inject and execute malicious scripts in the context of the affected web application, potentially leading to unauthorized actions or data exposure in users' browsers. The impact is limited to confidentiality and integrity with no availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Adobe's advisories for updates. Until a patch is available, consider restricting access to vulnerable form fields or applying web application firewall (WAF) rules to detect and block malicious input targeting these fields.