CVE-2026-47972 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. A low-privileged attacker can exploit this vulnerability by injecting malicious scripts into vulnerable form fields. When other users browse pages containing these fields, the injected scripts execute in their browsers, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation depends on vendor updates or workarounds.

The vulnerability allows execution of malicious JavaScript in the context of affected Adobe Experience Manager pages, potentially leading to information disclosure or user session compromise. The attacker requires low privileges to inject the script, and user interaction (browsing the affected page) is necessary for exploitation. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, users should monitor Adobe's security advisories for updates. Until a patch is available, consider restricting access to vulnerable form fields or applying input validation and output encoding where possible to mitigate injection risks.