CVE-2025-46944: Adobe Experience Manager XSS Vulnerability

CVE-2025-46944 Overview

CVE-2025-46944 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.22 and earlier, as well as AEM Cloud Service. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they view the page containing the affected field. The vulnerability requires user interaction and is classified under [CWE-79]: Improper Neutralization of Input During Web Page Generation.

Critical Impact

Attackers with low-level authenticated access can persist malicious scripts in AEM forms, leading to session compromise, credential theft, or unauthorized actions performed in the context of victim users including administrators.

Affected Products

• Adobe Experience Manager 6.5.22 and earlier
• Adobe Experience Manager Cloud Service (AEM CS)
• AEM Forms component (vulnerable form field handling)

Discovery Timeline

• 2025-06-10 - CVE-2025-46944 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46944

Vulnerability Analysis

The vulnerability resides in the input handling of form fields within Adobe Experience Manager. AEM fails to properly neutralize user-supplied input before storing it and rendering it back to other users. Because the malicious content is persisted server-side, every user who loads the affected page executes the injected script.

The attack requires authenticated access with low privileges, meaning any user with permission to submit or edit form content can plant the payload. User interaction is also required, as the victim must navigate to the page containing the injected field. The scope changes to another security boundary, allowing the injected script to affect resources beyond the vulnerable component.

Root Cause

The root cause is improper input sanitization and output encoding in AEM form field processing. User-controlled data is written to the page without contextual HTML or JavaScript escaping. This allows <script> tags or event handler attributes such as onerror and onload to survive the storage and rendering pipeline.

Attack Vector

An authenticated attacker with a low-privileged AEM account submits crafted content containing JavaScript into a vulnerable form field. AEM stores the payload in the content repository. When a victim, potentially including a content administrator, browses to the affected page, the stored script executes in their session context. The attacker can then hijack sessions, exfiltrate authentication cookies, perform CSRF-style actions, or modify displayed content.

No verified public exploit code is available for this vulnerability. Refer to the Adobe Security Advisory APSB25-48 for technical details.

Detection Methods for CVE-2025-46944

Indicators of Compromise

• Unexpected <script> tags, javascript: URIs, or event handler attributes (onerror, onload, onmouseover) stored in AEM form field content nodes.
• Outbound HTTP requests from user browsers to unfamiliar domains shortly after loading AEM pages.
• Anomalous authenticated sessions or administrator actions originating from unusual geolocations following AEM page visits.

Detection Strategies

• Audit the AEM content repository (JCR) for stored form field values containing HTML tags, script markers, or encoded JavaScript payloads.
• Enable and review AEM Dispatcher and application logs for form submissions containing suspicious characters such as <, >, and %3C.
• Deploy a Content Security Policy (CSP) in report-only mode to surface script violations originating from AEM-served pages.

Monitoring Recommendations

• Monitor low-privileged AEM accounts for form authoring activity outside expected workflows.
• Correlate form submission events with subsequent administrator page views to detect potential targeted stored XSS attacks.
• Alert on modifications to shared form templates or component definitions by non-administrative users.

How to Mitigate CVE-2025-46944

Immediate Actions Required

• Upgrade Adobe Experience Manager to the versions specified in Adobe Security Bulletin APSB25-48.
• Review and sanitize existing form field content stored in the JCR repository for previously injected payloads.
• Restrict form authoring permissions to trusted users and apply least-privilege principles to AEM roles.

Patch Information

Adobe released fixed versions addressing CVE-2025-46944. See the Adobe Security Advisory APSB25-48 for exact patched versions, service pack details, and AEM Cloud Service update guidance. AEM Cloud Service customers receive the fix through Adobe's managed update process.

Workarounds

• Enforce a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins.
• Deploy a Web Application Firewall (WAF) rule to filter HTML and JavaScript payloads in AEM form submissions.
• Temporarily remove or restrict access to affected form components until patches are applied.

# Example CSP header for AEM Dispatcher configuration
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"