CVE-2026-47946 is a DOM-based Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker can exploit this by manipulating the DOM environment to execute arbitrary JavaScript in the context of a victim's browser after the victim visits a crafted webpage. The vulnerability requires user interaction and has a changed scope, affecting confidentiality and integrity. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker to execute malicious scripts in the victim's browser, potentially leading to unauthorized disclosure or modification of sensitive information within the affected application context. There is no impact on system availability. The attack requires user interaction (visiting a malicious webpage).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted content and links. Monitor Adobe's advisories for updates on patches or mitigations.