CVE-2026-47991 is an improper redirect (open redirect) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. This vulnerability enables attackers to create URLs that redirect victims to untrusted external sites, potentially facilitating phishing or social engineering attacks. Exploitation requires the victim to click on a malicious link. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

The vulnerability could lead to user redirection to attacker-controlled sites, which may facilitate phishing or other social engineering attacks. The CVSS score indicates limited impact on confidentiality, no impact on integrity or availability, and requires user interaction. There is no direct indication of account takeover beyond the potential for social engineering.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should be cautious about clicking on unexpected or suspicious links related to Adobe Experience Manager. Monitor Adobe's official channels for updates on remediation.