CVE-2025-46887: Adobe Experience Manager XSS Vulnerability

CVE-2025-46887 Overview

Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability [CWE-79]. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they view the page containing the affected field. The flaw impacts both on-premises AEM deployments and AEM Cloud Service. Adobe published the fix in security bulletin APSB25-48.

Critical Impact

Attackers with low privileges can persist malicious scripts inside AEM form fields and execute code in the browsers of authenticated victims, enabling session theft and unauthorized actions.

Affected Products

• Adobe Experience Manager 6.5.22 and earlier (on-premises)
• Adobe Experience Manager Cloud Service (affected versions per APSB25-48)
• AEM Forms components accepting user-supplied field content

Discovery Timeline

• 2025-06-10 - CVE-2025-46887 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46887

Vulnerability Analysis

The vulnerability is a stored (persistent) XSS flaw in Adobe Experience Manager form field handling. AEM stores attacker-supplied input without sufficient output encoding. When another user renders the page containing that field, the browser interprets the injected content as executable script rather than data.

The scope is marked as changed, meaning the injected script executes in a security context different from the vulnerable component. This typically allows an attacker to reach data or actions belonging to the victim's authenticated session. Successful exploitation requires user interaction — a victim must visit the page hosting the poisoned field.

Because the payload is persisted server-side, every user who loads the affected page is exposed until an administrator removes the malicious content and applies the patch.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Form field values authored by low-privileged users are rendered back to viewers without contextual HTML or JavaScript encoding. Adobe's advisory APSB25-48 addresses the sanitization gap in the affected AEM components.

Attack Vector

An attacker authenticated with low privileges submits crafted content into a vulnerable form field. AEM stores the payload in the repository. When a victim — potentially an administrator or content author — navigates to the page rendering that field, the script executes in the victim's session. Common impacts include session token theft, forced administrative actions, defacement, and pivoting to further AEM content or configuration.

No verified public exploit code is available for this issue. See the Adobe Security Advisory APSB25-48 for vendor-supplied technical details.

Detection Methods for CVE-2025-46887

Indicators of Compromise

• Form field values in the AEM repository containing <script>, javascript:, onerror=, onload=, or encoded variants of these strings.
• Unexpected outbound requests from browsers of AEM authors or administrators to attacker-controlled domains after viewing content pages.
• Author or admin sessions performing repository changes that do not correlate with human activity.

Detection Strategies

• Audit AEM content nodes and form submissions for HTML or JavaScript syntax in fields that should hold plain text.
• Review AEM access.log and request.log for POST requests from low-privileged accounts writing suspicious payloads to form endpoints.
• Enable and review Content Security Policy (CSP) violation reports to surface unexpected inline script execution in AEM-rendered pages.

Monitoring Recommendations

• Forward AEM request, access, and audit logs to a centralized analytics platform for correlation with browser telemetry.
• Alert on new or modified content by non-privileged authors that contains script-like tokens or long base64 strings.
• Monitor authenticated author and admin browser sessions for anomalous DOM activity or credential-bearing requests to external hosts.

How to Mitigate CVE-2025-46887

Immediate Actions Required

• Apply the security update referenced in Adobe bulletin APSB25-48 to all AEM 6.5.x on-premises instances and confirm AEM Cloud Service instances are on a fixed release.
• Inventory low-privileged author accounts and rotate credentials for any account that appears to have submitted suspicious form content.
• Scan the AEM repository for stored payloads and remove any injected script content before restoring affected pages.

Patch Information

Adobe released fixes in security bulletin APSB25-48. Upgrade Adobe Experience Manager on-premises to a version later than 6.5.22 that includes the APSB25-48 fix, and validate that AEM Cloud Service tenants are on a patched release. Reference the vendor advisory for exact fixed versions and service pack identifiers.

Workarounds

• Restrict form-authoring permissions so only vetted users can submit content into fields rendered to other users.
• Deploy a strict Content Security Policy on AEM-delivered pages to block inline script execution and unauthorized external script sources.
• Place a web application firewall (WAF) in front of AEM to filter script tags and event-handler attributes in form submissions until patching completes.

# Example CSP header to reduce stored XSS impact on AEM-delivered pages
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report