CVE-2026-47981 is a stored Cross-Site Scripting (CWE-79) vulnerability affecting Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier. A low-privileged attacker can exploit this flaw by injecting malicious JavaScript into vulnerable form fields. When a victim visits a page containing the injected script, the malicious code executes in their browser, potentially leading to information disclosure or session hijacking. The vulnerability scope is changed, indicating a broader impact than initially assessed. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, and partial confidentiality and integrity impact. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker with low privileges to execute arbitrary JavaScript in the context of the victim's browser session when they access the vulnerable page. This can lead to partial confidentiality and integrity compromise, such as theft of sensitive information or manipulation of page content. Availability is not impacted. The vulnerability affects the confidentiality and integrity of user data processed by Adobe Experience Manager.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to vulnerable form fields and applying input validation or sanitization at the application level if feasible. Monitor Adobe's security advisories for updates and patches addressing this vulnerability.