CVE-2026-47936 is a stored Cross-Site Scripting (CWE-79) vulnerability affecting Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier. A low-privileged attacker can exploit this vulnerability by injecting malicious JavaScript into vulnerable form fields. When other users browse pages containing these fields, the injected scripts execute in their browsers, potentially leading to information disclosure or session hijacking. The vulnerability scope is changed, indicating a modification in impact or affected components. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, low privileges required, and requiring user interaction. No known exploits in the wild or vendor patches have been reported at this time.

Successful exploitation allows an attacker with low privileges to inject and execute malicious scripts in the browsers of users viewing the affected pages. This can lead to partial confidentiality and integrity impacts, such as theft of sensitive information or manipulation of web content in the victim's session. Availability is not affected. The vulnerability affects the confidentiality and integrity of user interactions with Adobe Experience Manager pages containing the vulnerable form fields.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to vulnerable form fields and applying input validation or output encoding as temporary mitigations. Monitor Adobe's security advisories for updates and patches addressing this vulnerability.