CVE-2026-27288 is a stored Cross-Site Scripting (CWE-79) vulnerability affecting Adobe Experience Manager versions FP11.7 and earlier. The flaw allows attackers with at least low privileges and requiring user interaction to inject malicious JavaScript into vulnerable form fields. When a victim accesses the affected page, the script executes in their browser context, potentially leading to limited confidentiality and integrity impacts. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, and partial impact on confidentiality and integrity without availability impact. No patch or official remediation level has been disclosed by Adobe as of the published date.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of the victim's browser when viewing the vulnerable page. This may lead to partial disclosure or modification of information accessible to the user session. There is no indication of availability impact or full system compromise. The vulnerability requires user interaction and some privileges to inject the malicious script. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to vulnerable forms and applying input validation or sanitization controls where possible. Monitor Adobe's security advisories for updates regarding patches or mitigations.