CVE-2025-46958: Adobe Experience Manager XSS Vulnerability

CVE-2025-46958 Overview

Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability [CWE-79]. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they visit the affected page. The flaw affects both on-premises AEM deployments and AEM Cloud Service. Adobe documented the issue in security bulletin APSB25-48 and released fixes for supported versions.

Critical Impact

Authenticated attackers can inject persistent JavaScript that runs in victims' browsers, enabling session theft, credential harvesting, and unauthorized actions in the AEM administrative context.

Affected Products

• Adobe Experience Manager 6.5.22 and earlier (on-premises)
• Adobe Experience Manager Cloud Service (affected releases)
• AEM authoring and publishing instances exposing vulnerable form components

Discovery Timeline

• 2025-08-05 - CVE-2025-46958 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46958

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw in form field handling within Adobe Experience Manager. Input submitted to specific form components is persisted without adequate output encoding. When another user renders a page that includes the stored value, the browser interprets the injected markup as executable script.

Exploitation requires an authenticated session with low privileges and some victim interaction, such as visiting the affected page. The issue crosses a security scope, so injected script executes with the privileges of the viewing user. This can include content authors, administrators, or end users of a published site.

Root Cause

The root cause is improper neutralization of user-controlled input during web page generation [CWE-79]. AEM's form field processing accepts script-bearing input and stores it in the JCR repository. Rendering logic then emits the stored value into HTML without context-appropriate escaping, allowing the payload to execute in the DOM.

Attack Vector

An attacker with author-level or comparable low-privilege access submits a crafted payload through a vulnerable form field. AEM persists the payload in the underlying repository. When a privileged user later views the containing page, the browser executes the script under the AEM origin. The attacker can steal session tokens, invoke authenticated API endpoints, modify content, or pivot to further internal targets.

No verified proof-of-concept is publicly available. See the Adobe Security Advisory APSB25-48 for vendor guidance.

Detection Methods for CVE-2025-46958

Indicators of Compromise

• Form field values in the JCR repository containing <script>, javascript:, or event handler attributes such as onerror= and onload=.
• Unexpected outbound HTTP requests from browsers of AEM authors or administrators to attacker-controlled domains.
• Session cookies or CSRF tokens appearing in web server logs of external hosts.

Detection Strategies

• Review AEM audit logs for content modifications by low-privileged users that touch form components or dialog fields.
• Query the JCR repository for stored property values containing HTML or JavaScript syntax in fields expected to hold plain text.
• Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution attempts on AEM pages.

Monitoring Recommendations

• Monitor authentication and session activity for AEM author accounts, focusing on anomalous logins following content edits.
• Alert on egress traffic from browsers accessing /editor.html or /content paths to non-approved external destinations.
• Track creation of new administrative users or permission changes that follow suspicious content submissions.

How to Mitigate CVE-2025-46958

Immediate Actions Required

• Upgrade Adobe Experience Manager to a version later than 6.5.22 following guidance in APSB25-48.
• Audit existing form component content for previously injected payloads and remove any malicious markup.
• Rotate session secrets and force re-authentication for author and administrator accounts if compromise is suspected.

Patch Information

Adobe released patches addressing this vulnerability in security bulletin APSB25-48. Customers running AEM on-premises should apply the corresponding service pack. AEM Cloud Service customers receive fixes through Adobe's managed release cycle. Refer to the Adobe Security Advisory APSB25-48 for exact version numbers and installation steps.

Workarounds

• Restrict author and contributor permissions to trusted users only and enforce least privilege on form component authoring.
• Enable a strict Content Security Policy on AEM-served pages to block inline scripts and unauthorized script sources.
• Place a web application firewall in front of AEM instances with rules that filter script tags and event handlers in form submissions.

# Example CSP header to restrict inline script execution on AEM responses
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"