CVE-2026-47974 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. A low-privileged attacker can exploit this issue by injecting malicious JavaScript into vulnerable form fields. When a victim accesses the page containing the injected script, the malicious code executes in their browser. The vulnerability impacts confidentiality and integrity but does not affect availability. The scope of the vulnerability is changed, indicating that the impact crosses security boundaries. No vendor advisory or patch information is currently available.

The vulnerability allows an attacker with low privileges to execute arbitrary JavaScript in the context of users visiting the affected pages, potentially leading to information disclosure and integrity issues such as session hijacking or unauthorized actions performed on behalf of the user. There is no impact on system availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to vulnerable form fields and applying input validation or output encoding as a temporary mitigation. Monitor Adobe's official channels for updates and patches.