CVE-2026-47944 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker with low privileges can inject malicious JavaScript into form fields that are not properly sanitized. When other users browse pages containing these fields, the injected scripts execute in their browsers, potentially compromising confidentiality and integrity. The vulnerability has a CVSS v3.1 base score of 5.4, indicating medium severity. No official remediation or patch information is currently provided by the vendor, and no known exploits are reported in the wild.

Successful exploitation can lead to the execution of arbitrary JavaScript in the context of affected users' browsers, potentially allowing theft of sensitive information or session hijacking. The impact is limited to confidentiality and integrity with no availability impact. The attacker requires low privileges and user interaction is required to trigger the malicious script.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to vulnerable forms to trusted users only and consider implementing input validation or sanitization controls at the application or web server level to mitigate injection of malicious scripts.