CVE-2026-48355
Analyzed Analyzed - Analysis Complete

Stored XSS in Adobe Experience Manager

Publication date: 2026-07-14

Last updated on: 2026-07-17

Assigner: Adobe Systems Incorporated

Description
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-14
Last Modified
2026-07-17
Generated
2026-08-04
AI Q&A
2026-07-15
EPSS Evaluated
2026-08-02
NVD
CVE-2026-48355
EUVD
EUVD-2026-44383

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
adobe experience_manager 6.5
adobe experience_manager 6.5
adobe experience_manager to 2020.5.0 (inc)
adobe experience_manager 6.5
adobe experience_manager to 6.5.25.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Adobe Experience Manager has a stored Cross-Site Scripting (XSS) vulnerability. A low-privileged attacker can inject malicious scripts into vulnerable form fields. When a victim visits the affected page, the malicious JavaScript executes in their browser.

Impact Analysis

An attacker could steal session cookies, redirect users to phishing sites, or perform actions on behalf of the user. This may lead to unauthorized access to sensitive data or account compromise.

Compliance Impact

This vulnerability could expose personal or sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations may face fines or penalties for failing to protect user data.

Mitigation Strategies

Apply the latest security patches or updates from Adobe for Experience Manager. Review and sanitize all form fields to prevent script injection. Restrict user privileges to minimize attack surface. Monitor affected systems for unusual activity or unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48355. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart