CVE-2026-47950 is a stored Cross-Site Scripting (CWE-79) vulnerability affecting Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker with low privileges can inject malicious JavaScript into form fields that are not properly sanitized. When other users browse pages containing these fields, the injected scripts execute in their browsers, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity. The scope of the vulnerability is changed, meaning the impact affects resources beyond the initially vulnerable component. No vendor advisory or patch information is currently available.

The vulnerability allows low-privileged attackers to inject and execute malicious scripts in the browsers of users viewing affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of user data or session tokens. Availability is not affected. The changed scope indicates that the impact crosses security boundaries within the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying input validation and output encoding on form fields as a temporary mitigation. Monitor Adobe's security advisories for updates and patches addressing this vulnerability.