CVE-2026-48304 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields, which is then executed in the context of users browsing the affected pages. The vulnerability impacts confidentiality and integrity but does not affect availability. The scope of the vulnerability is changed, indicating that the impact crosses security boundaries. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of users who visit the compromised pages, potentially leading to theft of sensitive information or session hijacking. The vulnerability affects confidentiality and integrity but does not impact availability. The attacker requires low privileges and user interaction is required to trigger the malicious script execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to vulnerable form fields and applying input validation or sanitization where possible to reduce risk. Monitor Adobe's official channels for updates and patches.