CVE-2026-47990 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. The vulnerability permits low-privileged attackers to inject malicious JavaScript into form fields that are stored and later rendered in the victim's browser, potentially leading to script execution in the context of the affected site. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and impacts on confidentiality and integrity but not availability. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of the affected Adobe Experience Manager instance, potentially leading to information disclosure or manipulation of data accessible to the victim user. The impact affects confidentiality and integrity but does not affect availability. The vulnerability requires user interaction and low privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to vulnerable form fields or applying input validation and output encoding as temporary mitigations. Monitor Adobe's security advisories for updates.