CVE-2026-27226 is a stored Cross-Site Scripting (CWE-79) vulnerability affecting Adobe Experience Manager up to version 6.5.23. Attackers can inject malicious JavaScript into form fields, which is then executed in the context of users' browsers when they access the compromised page. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity), with network attack vector, low attack complexity, requiring low privileges and user interaction, and impacts confidentiality and integrity with no availability impact.

Successful exploitation could lead to the execution of arbitrary JavaScript in the context of affected users' browsers, potentially allowing theft of sensitive information or session tokens. The impact is limited to confidentiality and integrity, with no reported impact on availability. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to vulnerable forms or applying input validation and output encoding as temporary mitigations. Monitor Adobe's security advisories for updates regarding patches or official mitigations.