CVE-2026-47942 is a stored Cross-Site Scripting (CWE-79) vulnerability affecting Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker with low privileges can inject malicious JavaScript into form fields that are not properly sanitized. When other users browse pages containing these fields, the injected scripts execute in their browsers, potentially compromising confidentiality and integrity. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity. The scope is changed, meaning the vulnerability affects components beyond the initially vulnerable boundary. No vendor advisory or patch information is currently available.

Successful exploitation allows a low-privileged attacker to execute arbitrary JavaScript in the context of other users' browsers when they access the vulnerable form fields. This can lead to information disclosure and integrity issues such as session hijacking or unauthorized actions performed on behalf of the victim. Availability impact is not indicated. The medium CVSS score reflects limited but meaningful impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to vulnerable form fields and applying input validation or output encoding at the application level if possible. Monitor Adobe's security advisories for updates.