CVE-2025-46890: Adobe Experience Manager XSS Vulnerability

CVE-2025-46890 Overview

Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability [CWE-79]. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in the browser of any victim who visits the page containing the affected field.

The issue affects both on-premises AEM 6.5.x deployments and AEM Cloud Service. Adobe published a fix in security bulletin APSB25-48.

Critical Impact
Authenticated attackers can persist JavaScript payloads that execute against other users, enabling session theft, credential harvesting, and unauthorized actions in AEM authoring or delivery contexts.

Affected Products

Adobe Experience Manager 6.5.22 and earlier (on-premises)
Adobe Experience Manager Cloud Service (AEM as a Cloud Service)
Component: adobe:experience_manager

Discovery Timeline

2025-06-10 - CVE-2025-46890 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46890

Vulnerability Analysis

The flaw is a stored XSS in AEM form field handling. AEM accepts user-controlled input into form field attributes without adequately sanitizing or encoding the value before storing it. When the containing page is rendered, the stored payload reaches the DOM and executes.

Exploitation requires an authenticated account with low privileges, such as a content contributor able to author or edit forms. User interaction is also required: a victim must browse to the page hosting the tainted field. Because the payload persists in AEM content, a single injection can affect many downstream viewers.

The scope change reflected in the CVSS vector indicates that injected script executes in the security context of the AEM-served origin, giving the attacker access to cookies, session data, and DOM APIs available to that origin.

Root Cause

The underlying weakness is improper neutralization of input during web page generation [CWE-79]. Form field values are stored and later reflected into HTML output without contextual output encoding suitable for the HTML, attribute, or JavaScript sinks in which they are rendered.

Attack Vector

An authenticated attacker with author-level access submits a form field value containing an HTML or JavaScript payload, for example script tags or event handler attributes such as onerror or onmouseover. AEM stores the value in the JCR repository. When another user (an author, administrator, or reader depending on the surface) loads the page, the browser parses the stored markup and executes the attacker's JavaScript.

No verified public proof-of-concept is available. See the Adobe Security Advisory APSB25-48 for the vendor's technical description.

Detection Methods for CVE-2025-46890

Indicators of Compromise

Form field values in the JCR repository containing HTML tags, <script> blocks, javascript: URIs, or DOM event handlers such as onerror=, onload=, or onclick=.
Unexpected outbound requests from author or publish instances to attacker-controlled domains triggered when pages render.
Session cookies for AEM users appearing in third-party logs or referer chains outside the trusted domain.

Detection Strategies

Audit AEM content packages and JCR nodes for form components whose stored properties contain HTML markup or JavaScript syntax that should not be present in plain-text form fields.
Enable and review AEM Dispatcher and access logs for POST requests to form endpoints containing suspicious payloads such as encoded angle brackets or javascript: schemes.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script executions that violate policy on AEM-hosted pages.

Monitoring Recommendations

Alert on authoring activity from low-privileged accounts that modifies form definitions or template properties across many pages in a short window.
Monitor browser telemetry and endpoint DNS logs for AEM users making requests to newly registered or uncategorized domains.
Track anomalous authentication events for AEM author accounts, including session reuse from unexpected IP addresses following a page visit.

How to Mitigate CVE-2025-46890

Immediate Actions Required

Upgrade on-premises AEM to a version later than 6.5.22 as specified in APSB25-48.
Confirm AEM as a Cloud Service tenants are on the current release channel, which Adobe patches automatically.
Review author and contributor accounts and remove privileges from users who do not need form-editing capabilities.

Patch Information

Adobe addressed CVE-2025-46890 in the June 2025 security update for Adobe Experience Manager. Apply the update packages referenced in Adobe Security Advisory APSB25-48. For AEM as a Cloud Service, Adobe applies fixes through the managed release process.

Workarounds

Configure AEM Dispatcher rules to reject request parameters containing raw <, >, or javascript: sequences on form-submission endpoints.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Enable AEM's XSS Protection API sanitization on custom form components that render user-supplied values.

bash

# Example AEM Dispatcher filter to block suspicious form payloads
/0100 { /type "deny" /url "*<script*" }
/0101 { /type "deny" /url "*javascript:*" }
/0102 { /type "deny" /url "*onerror=*" }