CVE-2026-47939 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields, which executes in the context of users viewing the affected pages. This can lead to partial compromise of confidentiality and integrity of user data. The vulnerability has a CVSS 3.1 base score of 5.4 with network attack vector, low attack complexity, low privileges required, and requires user interaction. The scope is changed, indicating impact beyond the vulnerable component. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of users who access the vulnerable form fields. This can lead to theft of sensitive information or session tokens, and manipulation of page content, impacting confidentiality and integrity. There is no impact on availability. The vulnerability requires user interaction and low privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to vulnerable forms and applying input validation or sanitization controls where possible. Monitor vendor communications for updates on patches or official mitigations.