CVE-2025-46935: Adobe Experience Manager XSS Vulnerability

CVE-2025-46935 Overview

Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability [CWE-79]. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they visit the page containing the compromised field. The vulnerability affects both on-premise deployments and AEM Cloud Service.

Critical Impact

Attackers with low privileges can inject persistent JavaScript payloads into AEM form fields, leading to session hijacking, credential theft, or unauthorized actions performed in the context of authenticated victims.

Affected Products

• Adobe Experience Manager 6.5.22 and earlier (on-premise)
• Adobe Experience Manager Cloud Service (affected versions per APSB25-48)
• AEM Forms component containing the vulnerable field handling

Discovery Timeline

• 2025-06-10 - CVE-2025-46935 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46935

Vulnerability Analysis

The flaw is a stored XSS issue in AEM form field handling. AEM fails to properly neutralize user-supplied input before storing it and later rendering it in a web page served to other users. Because the payload is persisted server-side, every user who loads the affected page executes the attacker's script automatically.

Exploitation requires an authenticated user with low privileges and requires the victim to browse to the page containing the injected content. The impact scope is changed, meaning the vulnerable AEM component can affect resources beyond its own security authority, such as parent applications, adjacent sessions, or authenticated administrative contexts.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. AEM form components accept attacker-controlled input, persist it, and later emit it into the HTML response without adequate output encoding or context-aware sanitization. Any JavaScript in the stored value executes in the browser of any user who renders the field.

Attack Vector

An attacker with a low-privileged AEM account submits a payload containing script content into a vulnerable form field. AEM stores the payload without stripping or encoding executable markup. When another user, including higher-privileged administrators, opens the page rendering that field, the browser parses and executes the injected script. The attacker can then exfiltrate session cookies, perform CSRF-style actions, deface content, or pivot to further internal reconnaissance.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-46935

Indicators of Compromise

• Form field values containing <script> tags, javascript: URIs, or event handlers such as onerror=, onload=, or onmouseover=.
• Unexpected outbound requests from browsers loading AEM authoring or preview pages, particularly to unknown domains.
• Anomalous POST requests to AEM form submission endpoints from low-privileged accounts containing HTML or JavaScript payloads.

Detection Strategies

• Review AEM request.log and dispatcher access logs for form submissions containing HTML-encoded script fragments or long, obfuscated string values.
• Inspect stored JCR content nodes tied to form components for markup that should not appear in plain text fields.
• Deploy a web application firewall (WAF) rule to alert on XSS signatures targeting /content/forms/ and related AEM paths.

Monitoring Recommendations

• Alert on authenticated sessions where a low-privileged AEM author account submits payloads containing script markup.
• Correlate browser-side errors and Content Security Policy (CSP) violation reports originating from AEM-served pages.
• Track sudden spikes in outbound requests from administrator workstations while they access AEM authoring interfaces.

How to Mitigate CVE-2025-46935

Immediate Actions Required

• Upgrade Adobe Experience Manager on-premise to the version specified in Adobe security bulletin APSB25-48, which supersedes 6.5.22.
• Ensure AEM Cloud Service instances are running the fixed release channel published by Adobe.
• Audit existing form field content for previously injected script payloads and remove any malicious entries.
• Rotate session tokens and administrative credentials if injected content is discovered in production instances.

Patch Information

Adobe published fixed builds in the Adobe Experience Manager Security Advisory APSB25-48. Apply the update for both on-premise AEM 6.5 deployments and AEM Cloud Service environments. Verify the installed version after patching and validate that the vulnerable form components are remediated.

Workarounds

• Restrict authoring permissions so only trusted, vetted users can submit content into form fields until patching is complete.
• Deploy a strict Content Security Policy on AEM-published sites to limit inline script execution and block unauthorized script sources.
• Configure the AEM dispatcher or an upstream WAF to filter form submissions containing HTML tags or JavaScript keywords.
• Enable AEM XSS Protection API sanitization on custom form components that render user input.

# Example dispatcher filter to block script content in form POSTs
/0100 { /type "deny" /method "POST" /url "/content/forms/.*" /query ".*<script.*" }
/0101 { /type "deny" /method "POST" /url "/content/forms/.*" /query ".*javascript:.*" }