CVE-2026-47972 is a stored Cross-Site Scripting (CWE-79) vulnerability affecting Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker with low privileges can inject malicious JavaScript into vulnerable form fields. When other users browse pages containing these fields, the injected scripts execute in their browsers, potentially compromising confidentiality and integrity. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity. No vendor advisory or patch information is currently available, and the vulnerability state is published.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session when they access the affected page. This can lead to information disclosure and integrity impacts such as session hijacking or unauthorized actions performed on behalf of the victim. Availability is not impacted. The attacker requires low privileges and user interaction (browsing to the vulnerable page).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to vulnerable form fields and applying input validation or output encoding as temporary mitigations.