CVE-2026-48301 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. The vulnerability allows an attacker with low privileges to inject malicious JavaScript into form fields that are stored and later rendered in pages viewed by other users. This can lead to script execution in the context of the victim's browser, potentially impacting confidentiality and integrity. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, with low confidentiality and integrity impact, and no availability impact. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of other users' browsers when they access affected pages. This may lead to information disclosure or manipulation of content within the victim's session. The vulnerability does not impact system availability. The attack requires low privileges and user interaction, and the scope of the impact is changed, indicating potential impact beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to vulnerable form fields and applying input validation or output encoding as temporary mitigations. Monitor Adobe's security advisories for updates and apply patches promptly once available.