CVE-2025-47066: Adobe Experience Manager XSS Vulnerability

CVE-2025-47066 Overview

Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in form field handling. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The injected payload executes in a victim's browser when they view the page containing the compromised field. The flaw affects both the on-premises Adobe Experience Manager product and the AEM Cloud Service offering.

Critical Impact
Attackers with low-privileged access can inject persistent JavaScript that executes in the context of higher-privileged users, enabling session theft, content manipulation, and unauthorized actions against the AEM instance.

Affected Products

Adobe Experience Manager 6.5.22 and earlier (on-premises)
Adobe Experience Manager Cloud Service
Any AEM deployment exposing the vulnerable form field component

Discovery Timeline

2025-06-10 - CVE-2025-47066 published to the National Vulnerability Database
2025-06-10 - Adobe publishes Security Advisory APSB25-48
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47066

Vulnerability Analysis

The vulnerability is a stored XSS flaw in Adobe Experience Manager form fields. Stored XSS persists the attacker payload on the server and delivers it to every user who loads the affected page. This delivery model separates stored XSS from reflected variants that require per-victim social engineering.

Exploitation requires an authenticated session with low privileges and user interaction from the victim. The vulnerability changes scope, meaning injected script can affect resources beyond the vulnerable component's security boundary. Confidentiality and integrity impact are limited, and there is no direct impact on availability.

Because AEM is widely deployed for enterprise content management, exploitation can target internal editors, marketers, and administrators who routinely browse authored pages. Successful injection allows an attacker to run arbitrary JavaScript in those higher-privileged sessions.

Root Cause

The root cause is improper neutralization of user-supplied input during web page generation [CWE-79]. AEM stores attacker-controlled content submitted through form fields without applying sufficient output encoding or input sanitization. When the stored value is rendered in a subsequent page view, the browser interprets embedded script tags or event handlers as executable JavaScript rather than inert text.

Attack Vector

The attack vector is network-based and requires authentication. An attacker with a low-privileged AEM account submits crafted content containing a JavaScript payload into a vulnerable form field. The payload is stored server-side within the AEM repository. When a victim, typically another editor or administrator, navigates to the page rendering that field, the browser executes the payload in the origin of the AEM instance. This enables session hijacking, unauthorized publishing actions, or credential harvesting via injected forms.

No verified public proof-of-concept exploit code is available. Refer to the Adobe Security Advisory APSB25-48 for vendor-supplied technical details.

Detection Methods for CVE-2025-47066

Indicators of Compromise

Form field values in the AEM JCR repository containing <script> tags, javascript: URIs, or DOM event handlers such as onerror and onload
Unexpected outbound HTTP requests from author or publish instances to attacker-controlled domains
Anomalous authoring activity from low-privileged accounts modifying form components
Browser console errors or content security policy violations on pages containing user-submitted form data

Detection Strategies

Audit the JCR repository for stored properties containing HTML control characters and script keywords in user-editable fields
Review AEM request.log and access.log entries for POST requests to form endpoints from low-privileged users
Deploy a Content Security Policy in report-only mode to surface inline script executions originating from stored content
Correlate authoring activity with subsequent page renders that trigger unexpected script execution

Monitoring Recommendations

Forward AEM access, request, and audit logs to a centralized SIEM for correlation across authoring and publishing tiers
Alert on modifications to form components by accounts that do not typically edit them
Monitor browser-side telemetry for CSP violations on AEM-hosted domains

How to Mitigate CVE-2025-47066

Immediate Actions Required

Apply Adobe's security update per Adobe Security Advisory APSB25-48 to AEM 6.5.22 and earlier deployments
Verify AEM Cloud Service instances are running the patched release channel
Review low-privileged author accounts and remove any that are unused or unnecessary
Audit existing form component content for stored script payloads

Patch Information

Adobe addressed CVE-2025-47066 in the June 2025 security update for Adobe Experience Manager. Customers on AEM 6.5 should install the latest service pack that supersedes 6.5.22. AEM Cloud Service customers receive the fix through Adobe's managed release process. Full remediation details are available in Adobe Security Advisory APSB25-48.

Workarounds

Enforce a strict Content Security Policy that blocks inline scripts on AEM-rendered pages
Restrict form component editing to trusted, higher-privileged roles until patching completes
Apply web application firewall rules that inspect POST payloads to AEM form endpoints for script injection patterns
Sanitize existing stored form field values by re-encoding HTML-sensitive characters

bash

# Example WAF rule pattern to block obvious script injection in AEM form submissions
SecRule REQUEST_URI "@beginsWith /content/" \
  "chain,deny,status:403,id:1004706,msg:'Potential XSS in AEM form field'"
  SecRule ARGS "@rx (?i)(<script|javascript:|onerror\s*=|onload\s*=)" "t:none,t:urlDecodeUni"