CVE-2026-47951 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields, which executes in the context of users viewing the affected pages. This can lead to partial confidentiality and integrity impact with no availability impact. The vulnerability changes the security scope, suggesting a broader impact than a typical XSS. No vendor advisory or patch information is available at this time, and no known exploits are reported in the wild.

Successful exploitation allows an attacker with low privileges to inject and execute malicious scripts in the browsers of users who visit the affected pages. This can lead to partial compromise of confidentiality and integrity of user data or session information. There is no impact on system availability. The scope change indicates that the vulnerability may allow crossing of security boundaries within the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to vulnerable form fields and applying input validation or output encoding as temporary mitigations. Monitor Adobe's security advisories for updates.