CVE-2026-47993 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker can exploit this by manipulating the DOM environment, causing malicious JavaScript to execute in the context of a victim's browser. This requires the victim to interact by visiting a specially crafted webpage. The vulnerability changes the security scope and impacts confidentiality and integrity of data accessible through the affected application. No vendor advisory or patch information is available at this time.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to unauthorized disclosure or modification of sensitive information within the context of Adobe Experience Manager. The vulnerability does not affect system availability. Exploitation requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted content and consider implementing web application firewall rules or other controls to detect and block malicious payloads targeting this vulnerability.