CVE-2026-48398: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager 6.5

CVE-2026-48398 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager 6.5. An attacker can exploit this by manipulating the DOM environment to execute arbitrary JavaScript code within the context of the victim's browser. This requires the victim to interact by visiting a specially crafted webpage. The vulnerability changes the security scope and affects versions from 0 up to and including 6.5.25.

Successful exploitation could lead to the execution of malicious scripts in the context of the victim's browser, potentially resulting in limited confidentiality and integrity impacts. There is no impact on availability. The attack requires user interaction and privileges to execute, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, monitor Adobe's advisories for updates. Until a fix is available, limit exposure by restricting access to untrusted content and educating users to avoid clicking suspicious links.