CVE-2026-47957 is a stored Cross-Site Scripting (CWE-79) vulnerability affecting Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04, and earlier. The vulnerability allows an attacker with low privileges to inject malicious JavaScript into form fields that are stored and later rendered in the application. When other users browse pages containing these fields, the malicious scripts execute in their browsers, potentially leading to information disclosure or session manipulation. The vulnerability has a CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and limited confidentiality and integrity impact without availability impact. No vendor advisory or patch information is currently available.

Successful exploitation allows a low-privileged attacker to inject and store malicious scripts in Adobe Experience Manager, which execute in the browsers of users who view the affected content. This can lead to limited confidentiality and integrity impacts such as theft of user data or session tokens. The vulnerability does not affect system availability. The scope is changed, meaning the vulnerability affects resources beyond the attacker’s privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to vulnerable form fields and applying input validation or sanitization controls where possible to reduce the risk of script injection.