CVE-2026-47985 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker can exploit this issue by manipulating the Document Object Model (DOM) environment to execute arbitrary JavaScript code within the context of a victim's browser. Successful exploitation requires the victim to interact by visiting a maliciously crafted webpage. The vulnerability changes the security scope, potentially allowing the attacker to affect components beyond the initial vulnerable context. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, required user interaction, changed scope, and limited confidentiality and integrity impact.

The vulnerability allows execution of malicious JavaScript in the victim's browser, potentially leading to unauthorized disclosure and modification of information within the affected web application context. There is no impact on system availability. The changed scope indicates that the vulnerability may affect resources beyond the originally intended security boundary.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor Adobe's security advisories for updates. Until a patch is available, limit exposure by restricting access to affected versions and educating users to avoid clicking on untrusted links that could trigger the vulnerability.