CVE-2026-47975 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. A low-privileged attacker can inject malicious JavaScript into form fields, which executes in the context of users visiting the affected pages. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity) with network attack vector, low attack complexity, requiring low privileges and user interaction, and impacts confidentiality and integrity with changed scope. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of users viewing the vulnerable pages, potentially leading to theft of sensitive information or manipulation of page content. The vulnerability affects confidentiality and integrity but does not affect system availability. The changed scope suggests that the vulnerability may allow crossing security boundaries or privilege escalation within the application context.

Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to vulnerable form fields and applying input validation or output encoding as temporary mitigations where feasible.