CVE-2026-48359 describes an Improper Restriction of XML External Entity Reference (XXE) vulnerability (CWE-611) in Adobe Experience Manager as a Cloud Service. The flaw allows an attacker with low privileges to exploit XML parsing to read sensitive files and potentially execute arbitrary code within the context of the current user. The vulnerability does not require user interaction and affects the security scope, potentially enabling privilege escalation or session compromise. The CVSS v3.1 base score is 9.6, indicating critical severity with network attack vector, low attack complexity, low privileges required, no user interaction, changed scope, and high impact on confidentiality and integrity.

Successful exploitation can lead to arbitrary code execution as the current user, unauthorized disclosure of sensitive files, and potential elevation of privileges or session takeover. The vulnerability affects confidentiality and integrity with no impact on availability. The scope change indicates that the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe whether the service is patched or mitigated server-side. Until an official fix or mitigation is announced, restrict access to the affected service and monitor for suspicious activity related to XML processing.