CVE-2026-47956 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager affecting versions up to 6.5.24 and 2026.04. The vulnerability permits a low-privileged attacker to inject malicious JavaScript into form fields that are then stored and executed in the browsers of users who access the affected content. This can lead to partial confidentiality and integrity impacts as indicated by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: None). The scope of the vulnerability is changed, indicating that the impact crosses security boundaries within the application. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker with low privileges to execute arbitrary JavaScript in the context of the victim's browser when they visit a page containing the vulnerable form field. This can lead to partial compromise of confidentiality and integrity of user data within the affected application context. There is no impact on availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Adobe's security advisories for updates. Until a patch is available, consider restricting access to vulnerable form fields or applying input validation and output encoding as temporary mitigations.