CVE-2026-47958 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier. It enables a low-privileged attacker to inject malicious JavaScript into vulnerable form fields, which executes in the context of users visiting the affected pages. This can lead to partial compromise of confidentiality and integrity of user data. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity) with attack vector network, low attack complexity, low privileges required, user interaction required, and scope changed.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of users who visit the affected pages, potentially leading to theft of sensitive information or manipulation of page content. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor Adobe's security advisories for updates and apply patches once available. Until then, consider restricting access to vulnerable forms or sanitizing inputs if possible.