CVE-2026-47977 is a stored Cross-Site Scripting (CWE-79) vulnerability affecting Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier. A low-privileged attacker can exploit this vulnerability by injecting malicious JavaScript into vulnerable form fields. When a victim accesses the page containing the injected script, the malicious code executes in their browser, potentially compromising confidentiality and integrity. The vulnerability scope is changed, indicating a broader impact than initially assessed. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, changed scope, and limited confidentiality and integrity impact. No vendor advisory or patch is currently available.

Successful exploitation allows execution of arbitrary JavaScript in the context of the affected web application, potentially leading to theft of user credentials, session tokens, or other sensitive information accessible to the browser. The attack requires user interaction (visiting a maliciously crafted page) and low privileges to inject the script. The integrity and confidentiality of affected users may be compromised, but availability is not impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying input validation and output encoding on form fields to mitigate injection risks. Restricting user privileges and monitoring for suspicious activity may reduce exposure. Avoid relying on generic mitigations unless specifically recommended by Adobe.