CVE-2025-46992: Adobe Experience Manager XSS Vulnerability

CVE-2025-46992 Overview

Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability [CWE-79]. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they visit the page containing the affected field. Exploitation requires user interaction and results in a scope change, allowing the attacker to impact resources beyond the vulnerable component. Adobe published a security advisory (APSB25-48) addressing this issue across both the on-premises and AEM Cloud Service editions.

Critical Impact
Authenticated attackers with low privileges can inject persistent JavaScript into form fields, enabling session hijacking, credential theft, and unauthorized actions in the context of AEM users.

Affected Products

Adobe Experience Manager on-premises versions 6.5.22 and earlier
Adobe Experience Manager Cloud Service (AEM as a Cloud Service)
Deployments exposing authoring or form-editing interfaces to low-privileged users

Discovery Timeline

2025-06-10 - CVE-2025-46992 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46992

Vulnerability Analysis

The vulnerability is a stored (persistent) XSS flaw in AEM form field handling. An authenticated attacker with content authoring privileges can submit crafted input containing JavaScript into a form field. AEM stores the input without sufficient sanitization or output encoding. When another user renders the page containing the field, the browser executes the attacker-controlled script within the AEM origin. Because the exploit crosses the security boundary between the attacker and the victim's session, the impact scope changes. The attacker can perform actions as the victim, exfiltrate session tokens, or pivot to administrative interfaces if the victim holds elevated privileges.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. AEM's form field component fails to escape or filter script-bearing characters before persisting user input or emitting it in HTML responses. This allows raw <script> tags, event handler attributes, and JavaScript URIs to survive the input-validation pipeline and reach the DOM.

Attack Vector

The attack is network-based and requires the attacker to hold a valid low-privileged AEM account with permission to edit form content. The attacker inserts a JavaScript payload into a vulnerable form field and saves the change. When any authenticated user, including administrators, opens the page containing the field, the payload executes automatically. Typical payloads target session cookies, CSRF tokens, or trigger authenticated requests to AEM administrative endpoints. The vulnerability does not require the victim to click a link beyond navigating to the compromised page.

No public proof-of-concept exploit is available at the time of publication. The vulnerability mechanism is described in the Adobe Experience Manager Security Update (APSB25-48).

Detection Methods for CVE-2025-46992

Indicators of Compromise

Form field values in the AEM content repository containing <script>, javascript:, onerror=, onload=, or other event-handler attributes
Unexpected outbound requests from authenticated user browsers to attacker-controlled domains carrying cookie or token data
Content modifications to form components made by low-privileged authors outside normal change windows

Detection Strategies

Audit the AEM Java Content Repository (JCR) for stored HTML or JavaScript in text-type form field properties using queries against /content and /conf paths
Review AEM audit.log and access.log entries for suspicious POST requests to form-editing endpoints from low-privileged accounts
Deploy Content Security Policy (CSP) headers in report-only mode and monitor violation reports for inline script execution originating from AEM-rendered pages

Monitoring Recommendations

Forward AEM dispatcher and publish-tier logs to a centralized SIEM for correlation of authoring activity with anomalous script execution
Alert on repeated 4xx or CSP violations tied to specific form component paths
Monitor privileged AEM session activity for behaviors consistent with cookie theft, such as session reuse from unexpected IP ranges

How to Mitigate CVE-2025-46992

Immediate Actions Required

Upgrade Adobe Experience Manager on-premises to the version specified in Adobe advisory APSB25-48
Confirm AEM Cloud Service tenants are running the patched release channel
Review all form components created or modified by low-privileged authors since the last known-good baseline and remove any script-bearing content
Rotate session tokens and administrator credentials if evidence of exploitation is found

Patch Information

Adobe released fixes for this vulnerability in the security bulletin Adobe Experience Manager Security Update (APSB25-48). Administrators should apply the service pack listed in the bulletin for on-premises 6.5.x deployments. AEM as a Cloud Service customers receive the patch through the managed release channel.

Workarounds

Restrict form-editing permissions to trusted authors only through AEM Access Control Lists until patching is complete
Enforce a strict Content Security Policy that blocks inline scripts and unauthorized script sources on AEM-published pages
Configure the AEM dispatcher to filter or reject responses containing suspicious script patterns in form-field output
Enable additional input sanitization in custom form component code by wrapping user input with the AEM XSSAPI encoding methods

bash

# Example Content Security Policy header for AEM dispatcher (Apache)
Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-{RANDOM}'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report"

# Restrict form component write access in AEM (repoinit)
deny jcr:write on /content/forms for authors-untrusted