CVE-2026-47989 is a DOM-based Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker can exploit this by manipulating the DOM environment, causing malicious JavaScript to execute within the victim's browser context. Exploitation requires user interaction (the victim must visit a crafted webpage). The vulnerability impacts confidentiality and integrity with no impact on availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to unauthorized disclosure or modification of information accessible to the browser session. The vulnerability does not affect system availability. The attack requires user interaction and is limited to the browser context of the victim.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when visiting untrusted or suspicious webpages. Monitor Adobe's official channels for updates and apply patches promptly once released.