CVE-2026-47956 is a stored Cross-Site Scripting (CWE-79) vulnerability affecting Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier. The vulnerability permits a low-privileged attacker to inject malicious JavaScript into form fields that persist and execute in the browsers of users viewing the affected content. The scope of the vulnerability is changed, indicating that the impact crosses security boundaries. The CVSS v3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and limited confidentiality and integrity impact. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser when they access the vulnerable page. This can lead to information disclosure and integrity impacts limited to the affected user session. The vulnerability requires user interaction and low privileges to exploit. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to vulnerable form fields or applying input validation and output encoding controls where possible to mitigate injection risks.