CVE-2026-47943 is a stored Cross-Site Scripting (CWE-79) vulnerability affecting Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier. The vulnerability allows an attacker with low privileges to inject malicious JavaScript into form fields that are stored and later rendered in the application. This can lead to script execution in the context of users who view the affected pages, potentially impacting confidentiality and integrity. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the browsers of users who visit the affected pages, potentially leading to theft of sensitive information or session hijacking. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires low privileges and user interaction, and the scope of the vulnerability is changed, indicating possible impact beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to vulnerable form fields and applying input validation or output encoding as temporary mitigations. Monitor Adobe's security advisories for updates on patches or official mitigations.