CVE-2025-46910: Adobe Experience Manager XSS Vulnerability

CVE-2025-46910 Overview

Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability [CWE-79]. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they navigate to the page rendering the affected field. The flaw affects both on-premises AEM deployments and AEM Cloud Service. Adobe addressed the issue in security bulletin APSB25-48.

Critical Impact
Stored XSS in AEM form fields enables session theft, credential harvesting, and content manipulation within the trust context of the AEM application.

Affected Products

Adobe Experience Manager 6.5.22 and earlier (on-premises)
Adobe Experience Manager Cloud Service (AEM CS)
AEM form authoring components handling user-controlled field content

Discovery Timeline

2025-06-10 - CVE-2025-46910 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46910

Vulnerability Analysis

The vulnerability is a stored XSS flaw in Adobe Experience Manager form field handling. An authenticated attacker with low privileges submits crafted input containing JavaScript into a form field. AEM persists the input without adequate output encoding or sanitization. When another user, including administrators or content authors, renders the page containing the field, the browser executes the injected script in the AEM origin.

Exploitation requires user interaction to visit the page containing the payload. The scope is changed, meaning the injected script can affect resources beyond the initially vulnerable component. Impact includes theft of session cookies, execution of authenticated actions on behalf of the victim, defacement of authored content, and pivoting to further attacks against AEM authors and administrators.

EPSS data reports a low near-term exploitation probability, and no public proof-of-concept or in-the-wild exploitation is currently tracked.

Root Cause

The root cause is insufficient neutralization of user-supplied input during web page generation [CWE-79]. AEM stores attacker-controlled content and later reflects it into HTML responses without contextual output encoding. Standard HTML, attribute, or JavaScript encoding routines are either missing or incorrectly applied for the affected form field rendering path.

Attack Vector

The attack vector is network-based and requires authentication as a low-privileged AEM user, such as a contributor or form editor. The attacker submits a payload into a susceptible form field. The stored payload triggers when a victim views the page. Because privileged users often review submitted content, this pattern allows privilege escalation through session hijacking or forced administrative actions.

No verified public exploit code is available. See the Adobe Security Advisory APSB25-48 for vendor-provided details.

Detection Methods for CVE-2025-46910

Indicators of Compromise

Form field values in the JCR repository containing <script>, javascript:, or event handler attributes such as onerror= and onload=.
Unexpected outbound HTTP requests from author or publish instances to attacker-controlled domains following page loads.
Author or administrator sessions performing actions inconsistent with normal workflow shortly after viewing user-submitted content.

Detection Strategies

Query the JCR for stored node property values matching XSS payload patterns across form-related resource types.
Inspect AEM Dispatcher and access logs for POST requests to form submission endpoints containing encoded script fragments.
Deploy Content Security Policy (CSP) reporting to surface inline script violations originating from authored pages.

Monitoring Recommendations

Monitor AEM audit logs for anomalous content modifications by low-privileged accounts.
Alert on browser-side CSP violation reports referencing AEM-hosted pages.
Track privileged user session activity that follows a review of externally submitted form content.

How to Mitigate CVE-2025-46910

Immediate Actions Required

Upgrade Adobe Experience Manager to the version listed in APSB25-48 (post-6.5.22 service pack or current AEM Cloud Service release).
Audit existing form field content for stored JavaScript payloads and remove any confirmed injections.
Rotate session tokens and credentials for author accounts that may have viewed malicious content.

Patch Information

Adobe published the fix in security bulletin APSB25-48. Apply the corresponding AEM 6.5 Service Pack update for on-premises deployments. AEM Cloud Service customers receive the patch through Adobe's managed release channel. Refer to the Adobe Security Advisory APSB25-48 for exact fixed versions and update procedures.

Workarounds

Enforce a strict Content Security Policy that blocks inline scripts on AEM-rendered pages.
Restrict form authoring and submission privileges to trusted users until patching is complete.
Configure AEM Dispatcher filter rules to reject request payloads containing HTML or JavaScript tokens in form field parameters.

bash

# Example AEM Dispatcher filter rule to block script-like payloads in form parameters
/0100 { /type "deny" /url '*<script*' }
/0101 { /type "deny" /url '*javascript:*' }
/0102 { /type "deny" /url '*onerror=*' }