CVE-2026-48304: Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Temporarily disable or restrict access to form fields that accept user-supplied content (the source of stored XSS) until an official vendor patch is available. Limit who can submit or edit form-handled content to trusted users.
Adobe Experience Manager vulnerable_form_fields = disabled or restricted - Compensating control
Deploy Web Application Firewall (WAF) / HTTP filtering to block common XSS payloads and patterns against AEM endpoints; restrict access to content-authoring and form-submission endpoints to trusted IPs and authenticated, high-privilege users where possible.
- Operational
Locate and sanitize existing stored content (form submissions, database entries, repositories) to remove injected scripts; restore affected pages from clean backups if needed. Monitor logs and alerts for signs of exploitation and review recent submissions for malicious payloads.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48304?
CVE-2026-48304 has a medium severity rating of 5.4.
How do I fix CVE-2026-48304?
To remediate CVE-2026-48304, upgrade to Adobe Experience Manager version 6.5.25 or later.
What type of vulnerability is CVE-2026-48304?
CVE-2026-48304 is a stored Cross-Site Scripting (XSS) vulnerability.
Who can exploit CVE-2026-48304?
A low-privileged attacker can exploit CVE-2026-48304 to inject malicious scripts.
Which versions of Adobe Experience Manager are affected by CVE-2026-48304?
Adobe Experience Manager versions 6.5.24, LTS SP1, and 2026.04 and earlier are affected by CVE-2026-48304.