CVE-2026-47949 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager affecting versions up to and including 6.5.24, LTS SP1, and 2026.04. The vulnerability permits a low-privileged attacker to inject malicious JavaScript into form fields that are stored and later executed in the context of users visiting the affected pages. This can lead to the execution of arbitrary scripts in the victim's browser, impacting confidentiality and integrity. The vulnerability scope is changed, indicating a broader impact than initially assessed. The CVSS 3.1 base score is 5.4 (medium severity), with network attack vector, low attack complexity, low privileges required, user interaction required, and scope changed. No vendor advisory or patch is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with low privileges to inject and store malicious scripts in Adobe Experience Manager form fields. These scripts execute in the browsers of users who access the affected pages, potentially leading to theft of sensitive information or manipulation of web content. The impact affects confidentiality and integrity but does not affect availability. The vulnerability has medium severity with a CVSS score of 5.4.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to vulnerable form fields and applying input validation or sanitization controls where possible. Monitor Adobe's official channels for updates and patches addressing this vulnerability.