CVE-2026-47978 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager affecting versions before 6.5.25 and 2026.05. The vulnerability permits low-privileged attackers to inject malicious JavaScript into form fields, which is then executed in the context of users' browsers when they access the affected pages. This can lead to scope changes and potential compromise of user interactions with the application. The CVSS 3.1 base score is 5.4, indicating medium severity with network attack vector, low attack complexity, requiring privileges, and user interaction. No vendor advisory or patch information is currently available.

An attacker with low privileges can inject malicious scripts into vulnerable form fields, which execute in the browsers of users who view those pages. This can lead to unauthorized actions or data exposure within the context of the affected application. The impact is limited to confidentiality and integrity with no availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to vulnerable form fields and applying input validation or sanitization where possible to reduce risk.