CVE-2026-47947 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker can exploit this by manipulating the DOM environment to execute arbitrary JavaScript in the context of a victim's browser. Exploitation requires the victim to visit a maliciously crafted webpage, involving user interaction. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity) with network attack vector, low attack complexity, low privileges required, user interaction required, changed scope, and impacts on confidentiality and integrity but not availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation can lead to execution of malicious scripts in the victim's browser, potentially compromising confidentiality and integrity of user data within the affected Adobe Experience Manager environment. There is no impact on availability. The attack requires user interaction and low privileges, with a changed scope indicating broader impact than initially scoped.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when interacting with untrusted content and consider applying any recommended workarounds from Adobe once available. Monitor Adobe's official security advisories for updates on patches or mitigations.