CVE-2026-47953 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. The vulnerability permits an attacker with low privileges to inject malicious JavaScript into form fields that are not properly sanitized. When other users browse pages containing these fields, the injected scripts execute in their browsers, potentially compromising confidentiality and integrity. The scope of the vulnerability is changed, indicating that the impact crosses security boundaries. No official patch or remediation guidance is currently provided by Adobe.

Successful exploitation could lead to the execution of arbitrary JavaScript in the context of the affected web application, resulting in limited confidentiality and integrity impacts. This may allow attackers to steal session tokens, perform actions on behalf of users, or deliver malicious payloads. Availability is not impacted. The vulnerability requires user interaction (UI:R) and low privileges (PR:L) to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply strict input validation and output encoding on form fields to mitigate injection risks. Additionally, consider restricting access to vulnerable forms to trusted users only and monitor for suspicious activity related to script injection.