CVE-2026-47987 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. The vulnerability allows an attacker to execute arbitrary JavaScript by manipulating the DOM environment when a victim visits a maliciously crafted webpage. The attack requires user interaction and impacts confidentiality and integrity with no impact on availability. The scope of the vulnerability is changed, indicating that the vulnerability affects resources beyond the initially vulnerable component.

Successful exploitation could lead to the execution of malicious scripts in the victim's browser, potentially allowing an attacker to access sensitive information or perform actions on behalf of the user within the affected application context. The CVSS vector indicates low attack complexity, requires low privileges, and user interaction is necessary. The impact is limited to confidentiality and integrity with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor Adobe's security advisories for updates. Until a patch is available, users should exercise caution with untrusted content and consider implementing web application firewall rules or other mitigations to detect or block malicious DOM manipulations if feasible.