CVE-2026-48355 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager as a Cloud Service. It enables attackers with low privileges to inject malicious JavaScript into form fields, which executes in the context of users browsing the affected pages. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity with network attack vector, low attack complexity, required privileges, and user interaction. The scope is changed, meaning the vulnerability affects resources beyond the attacker’s privileges. No vendor advisory or patch information is currently available.

Successful exploitation could lead to execution of arbitrary JavaScript in the browsers of users who visit the vulnerable pages, potentially allowing theft of sensitive information or session hijacking. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires user interaction and low privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if the service is managed and patched server-side. Until an official fix is available, consider restricting access to vulnerable forms or applying input validation and output encoding as temporary mitigations if feasible.