CVE-2025-46972: Adobe Experience Manager XSS Vulnerability

CVE-2025-46972 Overview

CVE-2025-46972 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when the victim navigates to a page containing the compromised field. The flaw is tracked under CWE-79 and affects both on-premises AEM and AEM Cloud Service deployments. Adobe published fixes in security bulletin APSB25-48.

Critical Impact
Authenticated attackers can inject persistent JavaScript that runs in the context of other users' sessions, enabling session data theft, defacement, and pivoting to higher-privileged accounts within AEM.

Affected Products

Adobe Experience Manager (on-premises) versions 6.5.22 and earlier
Adobe Experience Manager Cloud Service (affected releases prior to Adobe's fix)
AEM Forms components exposing vulnerable input fields

Discovery Timeline

2025-06-10 - CVE-2025-46972 published to NVD
2025-06-10 - Adobe publishes security advisory APSB25-48
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46972

Vulnerability Analysis

The vulnerability is a stored (persistent) XSS flaw affecting form field handling in Adobe Experience Manager. AEM stores attacker-supplied content in the repository without sufficient output encoding. When a subsequent user renders the page containing the tainted field, the browser interprets the injected payload as executable script. Because the payload persists server-side, every visitor to the affected page becomes a target until the content is remediated.

Exploitation requires authenticated access with low privileges and user interaction from the victim, who must visit the affected page. The scope is changed, meaning the injected script executes in a security context different from the vulnerable component. Successful exploitation can lead to session hijacking, credential capture through injected forms, and unauthorized actions performed on behalf of authors, editors, or administrators who view the poisoned content.

Root Cause

The root cause is improper neutralization of input during web page generation, classified under CWE-79. AEM form field handlers accept user-supplied values and later render them into HTML output without contextual encoding. Attackers exploit this gap by supplying values containing HTML or JavaScript syntax that survives storage and is emitted verbatim into the DOM.

Attack Vector

The attack proceeds in three stages. First, the attacker authenticates to AEM with a low-privileged account that has permission to edit or submit form fields. Second, the attacker submits a payload containing script content into a vulnerable form field, which AEM persists in the repository. Third, a victim with equal or greater privileges browses to the page containing the field, causing the browser to execute the payload under the origin of the AEM instance.

The vulnerability manifests wherever AEM renders stored form-field values without applying the appropriate encoding for the output context. For full technical remediation details, refer to the Adobe Security Advisory APSB25-48.

Detection Methods for CVE-2025-46972

Indicators of Compromise

Form field values in the AEM JCR repository containing <script>, javascript:, onerror=, onload=, or encoded variants of these tokens
Unexpected outbound requests from author or publish nodes to attacker-controlled domains originating from browser sessions
New or modified content nodes created by low-privileged accounts under /content/forms or similar author paths

Detection Strategies

Query the JCR repository for stored properties containing HTML tags or JavaScript event handlers, focusing on form-related node types
Inspect AEM access logs for POST requests from low-privileged users that submit payloads containing script markup to form endpoints
Deploy a Content Security Policy (CSP) in report-only mode and monitor CSP violation reports for inline script executions on AEM-rendered pages

Monitoring Recommendations

Forward AEM request.log, error.log, and audit logs to a centralized analytics platform for correlation of authoring activity with page views
Alert on repeated content edits by low-privileged accounts followed by page views from privileged users within short time windows
Baseline expected form-field content and flag deviations that introduce HTML tags, URI schemes, or event handler attributes

How to Mitigate CVE-2025-46972

Immediate Actions Required

Upgrade on-premises AEM installations to a version later than 6.5.22 as directed in Adobe Security Advisory APSB25-48
Confirm that AEM Cloud Service instances are running the Adobe-provided fixed release
Audit existing form-field content for injected script payloads and sanitize any tainted nodes before restoring normal operations
Review and tighten permissions so that only trusted accounts can author content rendered to broader audiences

Patch Information

Adobe addressed CVE-2025-46972 in the update published with security bulletin APSB25-48. Customers running on-premises AEM 6.5.22 or earlier must apply the vendor-supplied service pack or hotfix. AEM Cloud Service customers receive the fix through Adobe's managed release channel. See the Adobe Security Advisory APSB25-48 for exact version guidance.

Workarounds

Enforce a strict Content Security Policy that disallows inline script execution on AEM-rendered pages to blunt injected payloads
Place a Web Application Firewall (WAF) in front of AEM author and publish instances with rules that block HTML and script markup in form submissions
Restrict authoring privileges to reduce the number of accounts capable of submitting content to vulnerable form fields
Sanitize stored form-field values at render time using AEM's XSS API until upgrading is complete

bash

# Configuration example: minimal Content Security Policy header for AEM Dispatcher
# Add to the dispatcher or web server configuration serving AEM content
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"