CVE-2025-46984: Adobe Experience Manager XSS Vulnerability

CVE-2025-46984 Overview

CVE-2025-46984 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.22 and earlier, as well as AEM Cloud Service. The flaw allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields. When a victim browses to a page containing the injected field, the script executes in their browser session. Adobe published the fix in security bulletin APSB25-48. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Stored JavaScript executes in the browser of any authenticated user who views the affected AEM page, enabling session theft, content manipulation, and forced actions on behalf of the victim.

Affected Products

Adobe Experience Manager 6.5.22 and earlier
Adobe Experience Manager Cloud Service
AEM form components accepting unsanitized field input

Discovery Timeline

2025-06-10 - CVE-2025-46984 published to NVD
2025-06-10 - Adobe releases Security Advisory APSB25-48
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46984

Vulnerability Analysis

The vulnerability resides in how Adobe Experience Manager handles user-supplied input within specific form fields. AEM stores the attacker-supplied payload server-side and renders it later without adequate output encoding. When a user requests the affected page, the browser interprets the stored payload as executable script rather than data.

Exploitation requires an authenticated account with low privileges, which typically maps to content author or contributor roles in AEM installations. User interaction is required because the victim must navigate to the affected page. The scope changes across security boundaries, meaning script execution in the victim's browser can affect resources beyond the vulnerable component, including cookies, session tokens, and DOM content for the parent domain.

Root Cause

The root cause is improper neutralization of user input during web page generation, tracked as CWE-79. AEM accepts input into form fields without stripping or encoding HTML and JavaScript control characters. The payload persists in the content repository (JCR) and is served to subsequent viewers in an executable context.

Attack Vector

An authenticated attacker with author-level access submits a crafted payload through an affected form component. The payload is stored in the repository and rendered on any page that displays the field. Any visitor with permission to view the page executes the attacker's JavaScript in their browser, inheriting the victim's session context with the AEM domain. Refer to the Adobe Security Advisory APSB25-48 for the affected components list.

Detection Methods for CVE-2025-46984

Indicators of Compromise

Form field values in the JCR containing <script>, javascript:, onerror=, onload=, or encoded variants such as <script>
Author or contributor accounts submitting unusually long or HTML-formatted values to text fields
Unexpected outbound requests from user browsers to attacker-controlled domains following visits to AEM pages
Session cookie exfiltration attempts appearing in web proxy or CDN logs

Detection Strategies

Audit the AEM content repository for stored HTML or script markup in fields intended to hold plain text
Correlate low-privileged user activity with subsequent anomalous behavior on rendered pages
Review web application firewall logs for POST requests to AEM form endpoints containing script tags or event handlers
Monitor Content Security Policy violation reports for inline script executions from AEM origins

Monitoring Recommendations

Enable CSP reporting on all AEM-served pages to surface unexpected inline script execution
Ingest AEM access logs and author activity logs into a centralized SIEM for correlation
Alert on repeated failed input validation events tied to a single author account
Track user role assignments and privilege changes for author, contributor, and editor accounts

How to Mitigate CVE-2025-46984

Immediate Actions Required

Upgrade Adobe Experience Manager to the version identified in Adobe Security Advisory APSB25-48
Audit existing content for stored script payloads and remove or sanitize any suspicious entries
Review author and contributor account inventories and revoke unused low-privilege accounts
Rotate session secrets and force reauthentication after remediation

Patch Information

Adobe addressed CVE-2025-46984 in the June 2025 security release documented in bulletin APSB25-48. Customers running AEM on-premises should apply the service pack for the 6.5.x branch. AEM as a Cloud Service customers receive the fix automatically through Adobe's continuous delivery pipeline. Verify remediation by confirming the installed service pack version in the AEM Web Console.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Restrict author and contributor permissions using AEM's Access Control Lists until the patch is deployed
Deploy a web application firewall rule set that blocks script tags and event handler attributes in form submissions to AEM endpoints
Enable input validation dispatcher filters to reject requests containing HTML control characters in form parameters

bash

# Example AEM Dispatcher filter rule to block script payloads in form POSTs
/0100 { /type "deny" /method "POST" /url "*/content/*" /selectors '.*(<script|onerror=|onload=|javascript:).*' }