CVE-2026-47935 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager versions prior to 6.5.25. An attacker can exploit this by manipulating the DOM environment, causing malicious JavaScript to execute within the victim's browser context. The attack requires user interaction (visiting a crafted webpage). The vulnerability impacts confidentiality and integrity with a CVSS 3.1 base score of 5.4. No official remediation or patch is currently documented, and the vendor has not provided a remediation level. This vulnerability changes the security scope.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to information disclosure and integrity violations. There is no impact on availability. Exploitation requires user interaction, limiting the attack vector to scenarios where victims visit maliciously crafted pages.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted content and consider implementing web application firewall rules or other controls to detect and block malicious payloads targeting this vulnerability.