CVE-2026-47949 is a stored Cross-Site Scripting (CWE-79) vulnerability affecting Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier. A low-privileged attacker can exploit this vulnerability by injecting malicious JavaScript into vulnerable form fields. When a victim accesses the affected page, the injected script executes in their browser, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity. The scope of the vulnerability is changed, meaning the impact crosses security boundaries. No vendor advisory or patch information is currently available.

The vulnerability allows execution of malicious scripts in the context of a victim's browser, which can lead to limited confidentiality and integrity impacts such as theft of user data or session tokens. Availability is not affected. The attacker requires low privileges and user interaction (UI required). The scope change indicates the vulnerability affects components beyond the original security boundary.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to vulnerable forms, applying input validation or output encoding where possible, and educating users about the risk of interacting with untrusted content. Monitor Adobe's official channels for updates and patches.