CVE-2026-48266— Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Adobe | Adobe Experience Manager | ≤ 2026.04 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-48266
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Source: NVD (National Vulnerability Database)
Vulnerability Description
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Adobe Experience Manager 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Adobe Experience Manager是美国奥多比（Adobe）公司的一套可用于构建网站、移动应用程序和表单的内容管理解决方案。该方案支持移动内容管理、营销销售活动管理和多站点管理等。 Adobe Experience Manager 6.5.24版本、LTS SP1版本和2026.04及之前版本存在跨站脚本漏洞，该漏洞源于DOM环境操作，可能导致在受害者浏览器环境中执行恶意JavaScript。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Adobe | Adobe Experience Manager | 0 ~ 2026.04 | - |
II. Public POCs for CVE-2026-48266
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-48266
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-48266 (1)
Same Patch Batch · Adobe · 2026-06-09 · 123 CVEs total
| CVE-2026-48303 | 10.0 CRITICAL | Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) |
| CVE-2026-47938 | 10.0 CRITICAL | Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918) |
| CVE-2026-47928 | 9.6 CRITICAL | ColdFusion | Improper Input Validation (CWE-20) |
| CVE-2026-34691 | 9.3 CRITICAL | Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79) |
| CVE-2026-47932 | 8.8 HIGH | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' |
| CVE-2026-47906 | 8.6 HIGH | Dreamweaver Desktop | Dependency on Vulnerable Third-Party Component (CWE-1395) |
| CVE-2026-47929 | 8.4 HIGH | ColdFusion | Incorrect Authorization (CWE-863) |
| CVE-2026-47931 | 8.4 HIGH | ColdFusion | Improper Input Validation (CWE-20) |
| CVE-2026-47907 | 8.2 HIGH | Dreamweaver Desktop | Improper Access Control (CWE-284) |
| CVE-2026-47930 | 8.1 HIGH | ColdFusion | Improper Input Validation (CWE-20) |
| CVE-2026-34693 | 8.0 HIGH | Adobe Experience Manager Forms JEE | Cross-site Scripting (Reflected XSS) (CWE-79) |
| CVE-2026-34708 | 7.8 HIGH | InCopy | Stack-based Buffer Overflow (CWE-121) |
| CVE-2026-47919 | 7.8 HIGH | Acrobat Reader | Use After Free (CWE-416) |
| CVE-2026-34706 | 7.8 HIGH | InCopy | Out-of-bounds Write (CWE-787) |
| CVE-2026-47921 | 7.8 HIGH | Acrobat Reader | Use After Free (CWE-416) |
| CVE-2026-47920 | 7.8 HIGH | Acrobat Reader | Use After Free (CWE-416) |
| CVE-2026-34707 | 7.8 HIGH | InCopy | Heap-based Buffer Overflow (CWE-122) |
| CVE-2026-47913 | 7.8 HIGH | Acrobat Reader | Use After Free (CWE-416) |
| CVE-2026-47914 | 7.8 HIGH | Acrobat Reader | Use After Free (CWE-416) |
| CVE-2026-48305 | 7.8 HIGH | Substance3D - Sampler | Out-of-bounds Write (CWE-787) |
Showing top 20 of 123 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Adobe Experience Manager
- CVE-2026-47980
Adobe Experience Manager | Cross-site Scripting (Stored XSS) - CVE-2026-47945
Adobe Experience Manager | Cross-site Scripting (Stored XSS) - CVE-2026-48280
Adobe Experience Manager | Cross-site Scripting (DOM-based X - CVE-2026-47985
Adobe Experience Manager | Cross-site Scripting (DOM-based X - CVE-2026-47935
Adobe Experience Manager | Cross-site Scripting (DOM-based X
Same vendor: Adobe
- CVE-2026-47965
Acrobat Reader | Out-of-bounds Write (CWE-787) - CVE-2026-34711
CAI Content Credentials | Integer Overflow or Wraparound (CW - CVE-2026-34712
CAI Content Credentials | Improper Input Validation (CWE-20) - CVE-2026-47904
CAI Content Credentials | Uncontrolled Resource Consumption - CVE-2026-47903
CAI Content Credentials | Improper Input Validation (CWE-20)
Same weakness: CWE-79
- CVE-2026-54198
WordPress Media LIbrary Assistant plugin <= 3.35 - Reflected - CVE-2026-54191
WordPress Pods plugin <= 3.3.8 - Cross Site Scripting (XSS) - CVE-2026-39437
WordPress Min Max Step Quantity Limits Manager for WooCommer - CVE-2026-10093
File Sharing & Download Manager <= 2.1.6 - Authenticated (Su - CVE-2026-48157
Slim has Reflected XSS in the HtmlErrorRenderer
V. Comments for CVE-2026-48266
No comments yet