CVE-2026-47970 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields, which executes in the context of a victim's browser upon visiting the affected page. This vulnerability impacts confidentiality and integrity but not availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of users viewing the affected pages, potentially leading to information disclosure or manipulation of data accessible to the victim. The vulnerability does not affect system availability. The CVSS vector indicates network attack vector, low attack complexity, requires low privileges and user interaction, with changed scope and partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to vulnerable form fields or applying input validation and output encoding as temporary mitigations. Monitor Adobe's security advisories for updates.