CVE-2026-47945 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker with low privileges can inject malicious JavaScript into form fields that are not properly sanitized. When a victim accesses the page containing the injected script, the malicious code executes in their browser, potentially compromising confidentiality and integrity. The vulnerability scope is changed, indicating a possible impact beyond the immediate component. No official remediation or patch information is currently available.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session when they visit the affected page. This can lead to information disclosure and integrity issues, such as theft of session tokens or manipulation of page content. Availability is not impacted. The attack requires user interaction (UI:R) and low privileges (PR:L).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to vulnerable form fields and applying input validation or output encoding as temporary mitigations if feasible. Monitor Adobe's security advisories for updates.