CVE-2026-47993 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager affecting versions >=6.5.0 <=6.5.24 and <=2026.04. The vulnerability arises from improper handling of the DOM environment, enabling an attacker to execute arbitrary JavaScript code within the victim's browser context. Exploitation requires the victim to interact by visiting a maliciously crafted webpage. The vulnerability impacts confidentiality and integrity with limited privileges required and user interaction necessary. The scope of the vulnerability is changed, indicating that the vulnerability affects resources beyond the initially vulnerable component.

Successful exploitation can lead to execution of arbitrary JavaScript in the context of the victim's browser, potentially allowing theft of sensitive information or manipulation of the user interface. The impact is limited to confidentiality and integrity with no impact on availability. The attack requires user interaction and low privileges, which reduces the likelihood but does not eliminate risk.

No official patch or remediation level has been published by Adobe at this time. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted links and avoid visiting suspicious webpages that could trigger the vulnerability.