CVE-2025-46945: Adobe Experience Manager XSS Vulnerability

CVE-2025-46945 Overview

Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability [CWE-79]. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when the victim visits the page rendering the affected field. Exploitation requires user interaction and low-tier authentication, and the scope is changed because injected scripts can affect resources beyond the vulnerable component's security context. Adobe published the fix in Security Advisory APSB25-48.

Critical Impact
Authenticated attackers can persist JavaScript in AEM form fields to hijack sessions, steal data, or perform actions in the context of any user viewing the affected page.

Affected Products

Adobe Experience Manager 6.5.22 and earlier (on-premise)
Adobe Experience Manager Cloud Service
Adobe Experience Manager Forms components rendering user-supplied field content

Discovery Timeline

2025-06-10 - CVE-2025-46945 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46945

Vulnerability Analysis

The flaw is a stored XSS condition in Adobe Experience Manager form field handling. AEM accepts field content from a low-privileged authoring or submitting user and later renders it into HTML output without sufficient contextual encoding. When another user, potentially with higher privileges, loads the page containing the injected field, the browser parses attacker-controlled markup and executes the embedded script.

Because the vulnerability is stored rather than reflected, no phishing lure or crafted link is required after the initial injection. Every subsequent visitor to the affected page becomes a target. The changed CVSS scope indicates the injected script can reach data or functionality outside the AEM component's own security boundary, including cookies, session tokens, or authenticated administrative actions in the same origin.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. AEM stores user-supplied form field values and later reflects them into rendered pages without escaping HTML control characters or applying an output encoder appropriate for the injection context. Form components that expect plain text data instead pass raw markup to the client renderer.

Attack Vector

An attacker authenticates to AEM with low-tier privileges sufficient to submit or edit form content. The attacker stores a JavaScript payload inside a vulnerable form field, for example an event handler attribute or a <script> fragment. When any user browses to the page that renders the field, the payload executes in that user's session. Refer to the Adobe Security Advisory APSB25-48 for the list of affected components and technical detail.

Detection Methods for CVE-2025-46945

Indicators of Compromise

Form field values in AEM content repositories containing <script>, javascript:, or HTML event handler attributes such as onerror= or onload=.
Unexpected outbound requests from authenticated user sessions to attacker-controlled domains shortly after rendering AEM pages.
Repository audit entries showing low-privileged accounts modifying form fields on high-visibility pages.

Detection Strategies

Query the AEM JCR repository for stored form node properties containing HTML tags or JavaScript URI schemes.
Inspect web server and CDN logs for responses that echo attacker-supplied strings back into HTML without encoding.
Correlate authoring activity with subsequent anomalous session behavior from privileged users viewing the same content path.

Monitoring Recommendations

Enable AEM audit logging on form authoring and submission endpoints, and forward events to a centralized analytics platform.
Monitor Content Security Policy (CSP) violation reports for inline script executions on AEM-served pages.
Alert on new or modified form components authored by accounts that do not normally publish content.

How to Mitigate CVE-2025-46945

Immediate Actions Required

Upgrade AEM on-premise to the fixed version listed in Adobe Security Advisory APSB25-48 and confirm AEM Cloud Service instances are running a patched release.
Audit existing form field content for injected markup and remove or sanitize any suspicious entries.
Review and tighten permissions so only trusted roles can author or edit form fields.

Patch Information

Adobe released fixes as part of APSB25-48. On-premise operators should apply the cumulative service pack that supersedes AEM 6.5.22. AEM as a Cloud Service customers receive the update through Adobe's managed release channel. Validate the fix by confirming that form field output is HTML-encoded in rendered pages.

Workarounds

Deploy a Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Place a web application firewall rule in front of AEM to block form submissions containing HTML tags or JavaScript URI schemes in text fields.
Restrict low-privileged author roles from editing form components on public-facing pages until the patch is deployed.

bash

# Example CSP response header for AEM dispatcher to reduce stored XSS impact
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report"