CVE-2026-47935 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager. It affects versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker can exploit this issue by manipulating the DOM environment, causing malicious JavaScript to execute within the victim's browser context. Exploitation requires the victim to visit a specially crafted webpage, and the vulnerability changes the security scope. The CVSS v3.1 base score is 5.4, indicating medium severity, with attack vector network, low attack complexity, low privileges required, user interaction required, and impacts on confidentiality and integrity.

Successful exploitation can lead to unauthorized execution of JavaScript in the victim's browser, potentially exposing sensitive information or allowing unauthorized actions within the context of the affected application. The vulnerability affects confidentiality and integrity but does not impact availability. Exploitation requires user interaction and low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted content and consider applying any recommended workarounds from Adobe. Monitor Adobe's official channels for updates and patches addressing this vulnerability.