CVE-2025-46964: Adobe Experience Manager XSS Vulnerability

CVE-2025-46964 Overview

Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability [CWE-79]. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they view the affected page. The flaw affects both AEM on-premise deployments and AEM as a Cloud Service. Adobe addressed the issue in security bulletin APSB25-48.

Critical Impact
Stored XSS in AEM form fields enables authenticated attackers to execute arbitrary JavaScript in the browsers of users visiting affected pages, with a scope change that can impact resources beyond the vulnerable component.

Affected Products

Adobe Experience Manager 6.5.22 and earlier (on-premise)
Adobe Experience Manager as a Cloud Service (AEM CS)
AEM Forms components rendering user-supplied field content

Discovery Timeline

2025-06-10 - CVE-2025-46964 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46964

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw in Adobe Experience Manager form components. AEM fails to sanitize or encode attacker-controlled input before persisting it and rendering it back to end users. The payload is stored server-side and executes each time an affected page is loaded, producing a persistent client-side compromise vector.

Exploitation requires an authenticated account with low privileges and user interaction from the victim. The scope is changed, meaning the injected script can affect content outside the immediate security boundary of the vulnerable component. Successful exploitation can lead to session token theft, unauthorized actions performed as the victim, or redirection to attacker-controlled infrastructure.

The EPSS score is 0.349%, indicating a low probability of exploitation activity within the next 30 days.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Form field values submitted by authenticated authors or contributors are stored without sufficient output encoding. When AEM subsequently renders these values in HTML context, script tags and event-handler attributes are interpreted by the browser rather than treated as literal text.

Attack Vector

An attacker with author-level access submits form content containing JavaScript payloads through a vulnerable field. AEM persists the payload in the JCR repository. When a legitimate user, including higher-privileged administrators, navigates to a page containing the field, the browser executes the stored script under the origin of the AEM instance. See the Adobe Security Advisory APSB25-48 for vendor-provided technical detail.

Detection Methods for CVE-2025-46964

Indicators of Compromise

Form field values containing <script>, javascript:, or HTML event handlers such as onerror= and onload= stored in the JCR repository
Unexpected outbound requests from author or publish instances to attacker-controlled domains following page rendering
Session cookies or authentication tokens observed in referer headers or DNS logs pointing to external hosts

Detection Strategies

Audit AEM content repositories for form field properties containing HTML or script markup using JCR queries
Inspect web server and CDN access logs for anomalous query strings or POST payloads targeting AEM form submission endpoints
Deploy Content Security Policy (CSP) reporting to surface script-src violations on AEM-rendered pages

Monitoring Recommendations

Enable and centralize AEM audit logs covering AuthoringUI and page modification events
Monitor for privilege changes or unusual page-edit activity from low-privilege author accounts
Alert on browser telemetry showing script execution from AEM origins that references external domains

How to Mitigate CVE-2025-46964

Immediate Actions Required

Upgrade Adobe Experience Manager to the version specified in APSB25-48; AEM as a Cloud Service customers should confirm they are on the current release
Review and revoke unnecessary author-level accounts to reduce the population of users who can inject stored payloads
Audit existing form field content for previously injected scripts and remediate before applying the patch

Patch Information

Adobe released fixed versions of Adobe Experience Manager addressing this issue in security bulletin APSB25-48. On-premise customers running AEM 6.5.22 or earlier must apply the corresponding service pack. AEM as a Cloud Service instances receive the fix through the standard Adobe update channel. Refer to the Adobe Security Advisory APSB25-48 for exact fixed versions and update procedures.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts on AEM-rendered pages
Restrict author permissions on form components so only trusted users can modify persisted field content
Deploy a web application firewall rule to reject requests containing HTML or script markup submitted to form endpoints