DOM-based Cross-Site Scripting Vulnerability in Adobe Experience Manager
CVE-2026-48254

5.4MEDIUM

Key Information:

Vendor: Adobe
Status: Adobe Experience Manager As A Cloud Service; Adobe Experience Manager 6.5 Lts; Adobe Experience Manager 6.5
Vendor: CVE Published:; 14 July 2026

What is CVE-2026-48254?

Adobe Experience Manager is susceptible to a DOM-based Cross-Site Scripting (XSS) vulnerability that allows attackers to inject and execute malicious JavaScript code within the victim's web browser. This exploitation requires user interaction; specifically, victims must visit a specially crafted webpage designed to manipulate the DOM environment. The implications of this vulnerability can compromise the security and integrity of user data.

Affected Version(s)

Adobe Experience Manager 6.5 0 <= 6.5.25

Adobe Experience Manager 6.5 LTS 0

References

https://helpx.adobe.com/security/products/experience-mana...

vendor-advisory

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 14, 2026
Vulnerability Reserved
May 21, 2026

CVE-2026-48254 Data

JSON