CVE-2026-48355: Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2026-48355?
The severity of CVE-2026-48355 is medium with a score of 5.4.
What is CVE-2026-48355 about?
CVE-2026-48355 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager that allows attackers to inject malicious scripts.
Who is affected by CVE-2026-48355?
Low-privileged attackers can exploit CVE-2026-48355 to inject malicious scripts into vulnerable form fields.
How can CVE-2026-48355 be exploited?
CVE-2026-48355 can be exploited by injecting malicious JavaScript into a vulnerable form field that executes in a victim's browser.
How do I fix CVE-2026-48355?
To mitigate CVE-2026-48355, implement proper input validation and output encoding for form fields in Adobe Experience Manager.