CVE-2026-47980 is a stored Cross-Site Scripting (CWE-79) vulnerability affecting Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier. It enables a low-privileged attacker to inject malicious JavaScript into vulnerable form fields. When a victim accesses a page containing the injected script, the malicious code executes in their browser. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity. The scope of the vulnerability is changed, implying that the impact extends beyond the initially affected component. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with low privileges to execute arbitrary JavaScript in the context of users visiting the affected pages. This can lead to information disclosure or manipulation of user interactions within the affected Adobe Experience Manager instance. The vulnerability does not impact availability but affects confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to vulnerable form fields and applying input validation or sanitization controls where possible to reduce risk.