CVE-2026-47973 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker with low privileges can inject malicious JavaScript into vulnerable form fields. When other users browse pages containing these fields, the injected scripts execute in their browsers, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity. As of the published date, no official fix or remediation level has been announced by Adobe.

The vulnerability enables attackers with low privileges to inject and execute malicious scripts in the browsers of users who visit affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of user data or manipulation of page content. Availability is not impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting access to vulnerable form fields and applying web application firewall rules to detect and block suspicious input patterns related to XSS. Monitor Adobe's advisories for updates on patches or official mitigations.