# CVE-2026-48260: Adobe Experience Manager DOM-based XSS

Source: https://junglewise.ai/threats/cve-2026-48260-adobe-experience-manager-dom-based-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-48260 · Severity: medium · CVSS 5.4 · Published 2026-07-14

Adobe Experience Manager, a platform used by organizations to manage digital content and assets, is affected by a security vulnerability that could allow an attacker to execute malicious code in a user's browser. To exploit this, an attacker would need to trick a logged-in user into visiting a specially crafted link. If successful, the attacker could potentially access sensitive information or perform actions on behalf of the user within the application.

Technologies: [Adobe Experience Manager Cloud Service](https://junglewise.ai/threats/technologies/experience-manager-cloud-service). Vendors: [Adobe](https://junglewise.ai/threats/vendors/adobe).

## Quick answers

**Is CVE-2026-48260 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48260 being exploited in the wild.

**How severe is CVE-2026-48260?** Medium severity, with a CVSS score of 5.4, published 14 July 2026.

**Which products and versions are affected?** Adobe Experience Manager Cloud Service <= 2026.5.0.

**Is there a fix for CVE-2026-48260?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48260 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48260?** Check whether you run Adobe Experience Manager Cloud Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79) exists in Adobe Experience Manager. The flaw occurs when the application improperly neutralizes user-controlled input that is subsequently used to modify the Document Object Model (DOM) in the victim's browser. An attacker with low-privileged network access can exploit this by inducing a user to interact with a malicious URL. Successful exploitation allows for the execution of arbitrary JavaScript in the victim's browser session, potentially leading to session hijacking or unauthorized data access. The issue is resolved in AEM Cloud Service 2026.6.0 and specific hotfixes for version 6.5.

## Affected products

- Adobe Adobe Experience Manager as a Cloud Service <= 2026.5.0
- Adobe Adobe Experience Manager 6.5 LTS <= SP1
- Adobe Adobe Experience Manager 6.5 <= 6.5.24

## Timeline

- 2026-07-14: advisory
- 2026-07-14: disclosed

## References

- [https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html](https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html)

## Related threats

- [Adobe Experience Manager reflected XSS](https://junglewise.ai/threats/cve-2026-123341-adobe-experience-manager-is-affected-by-a-reflected-cross-site)
- [Adobe Experience Manager stored XSS in form fields](https://junglewise.ai/threats/cve-2026-123259-adobe-experience-manager-is-affected-by-a-stored-cross-site)
- [Adobe Experience Manager incorrect authorization leading to code execution](https://junglewise.ai/threats/cve-2026-123258-adobe-experience-manager-is-affected-by-a-dom-based-cross-site)
- [Adobe Experience Manager input validation bypass](https://junglewise.ai/threats/cve-2026-118482-adobe-experience-manager-is-affected-by-an-improper-input)
- [Adobe Experience Manager DOM-based cross-site scripting in Forms](https://junglewise.ai/threats/cve-2026-118481-adobe-experience-manager-is-affected-by-a-dom-based-cross-site)