CVE-2025-47006: Adobe Experience Manager XSS Vulnerability

CVE-2025-47006 Overview

Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability [CWE-79]. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when the user visits a page rendering the affected field. The flaw affects both AEM on-premises deployments and AEM Cloud Service configurations. Adobe published the fix in Security Bulletin APSB25-48.

Critical Impact
Attackers can execute arbitrary JavaScript in victim browsers, enabling session theft, credential harvesting, and content manipulation within the AEM authoring environment.

Affected Products

Adobe Experience Manager 6.5.22 and earlier
Adobe Experience Manager Cloud Service (affected release trains)
AEM Forms components handling user-controlled field data

Discovery Timeline

2025-06-10 - CVE-2025-47006 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47006

Vulnerability Analysis

The vulnerability is a stored XSS flaw in Adobe Experience Manager form field handling. AEM fails to sanitize user-supplied input before persisting it and rendering it back to other users. The scope change indicates that injected script executes in a security context different from the vulnerable component. Exploitation requires authenticated access with low privileges and user interaction to trigger the payload. Because AEM authors and administrators typically hold elevated permissions, script execution in their browsers can lead to privileged action abuse through cross-site request forgery patterns.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Form field values are stored and later rendered without adequate output encoding or input validation. Adversary-controlled markup in these fields is interpreted as active content by the victim's browser rather than treated as inert text.

Attack Vector

An authenticated attacker with low privileges submits a payload containing <script> or event-handler attributes into a vulnerable form field. AEM persists the payload in the content repository. When another user, such as a reviewer or administrator, loads a page that renders the field, the browser executes the attacker's JavaScript within the AEM origin. This allows session cookie exfiltration, DOM manipulation, and forced actions in the AEM console.

// No verified public proof-of-concept exists for this CVE.
// Refer to Adobe Security Bulletin APSB25-48 for vendor technical details.

Detection Methods for CVE-2025-47006

Indicators of Compromise

Form field values in the AEM content repository containing <script>, javascript:, onerror=, or onload= substrings
Outbound HTTP requests from author or publish nodes to unfamiliar external domains referenced by rendered pages
Unexpected session cookie access patterns or administrative actions initiated from author accounts

Detection Strategies

Audit jcr:content node properties for HTML or JavaScript syntax in fields expected to hold plain text
Deploy a Content Security Policy (CSP) with report-uri to capture inline script violations on AEM-rendered pages
Correlate web server access logs for anomalous POST requests to form-submission endpoints followed by GET requests from privileged users

Monitoring Recommendations

Enable AEM audit logging for content modification events on form components and review daily
Monitor browser telemetry from author accounts for unexpected script execution or credential prompts
Track outbound network flows from AEM instances to identify data exfiltration channels

How to Mitigate CVE-2025-47006

Immediate Actions Required

Apply the AEM 6.5.23 security update or the current AEM Cloud Service release referenced in Adobe Security Bulletin APSB25-48
Restrict form authoring privileges to trusted users and enforce least privilege on content contributor roles
Review all stored form field content for previously injected payloads and remediate affected nodes

Patch Information

Adobe released the fix in Security Bulletin APSB25-48. Upgrade Adobe Experience Manager to version 6.5.23 or later, or apply the corresponding AEM Cloud Service update. Full details are available in the Adobe Security Bulletin APSB25-48.

Workarounds

Deploy a strict Content Security Policy that disallows inline scripts on AEM-rendered pages until patching is complete
Enable AEM's XSS Protection API and confirm output encoding is applied to all custom form components
Place a web application firewall (WAF) rule in front of AEM to block form submissions containing HTML or script tags in text-only fields

bash

# Example CSP header to reduce stored XSS impact on AEM responses
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'";