CVE-2025-47073: Adobe Experience Manager XSS Vulnerability

CVE-2025-47073 Overview

CVE-2025-47073 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.22 and earlier, including AEM Cloud Service. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in the browser of any user who visits a page rendering the affected field. The flaw is classified under CWE-79 and requires user interaction to trigger. Adobe addressed the issue in security advisory APSB25-48.

Critical Impact
Authenticated attackers can persist JavaScript in AEM content, hijacking sessions of authors, administrators, or end users who load the affected page.

Affected Products

Adobe Experience Manager 6.5.22 and earlier (on-premises)
Adobe Experience Manager Cloud Service (AEM CS)
AEM Forms components with vulnerable form field rendering

Discovery Timeline

2025-06-10 - CVE-2025-47073 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47073

Vulnerability Analysis

The vulnerability is a stored XSS flaw in Adobe Experience Manager form field handling. AEM fails to sanitize or encode attacker-supplied input written to form field attributes or values. The injected script persists in the AEM repository and executes each time a victim loads the page containing the compromised field.

The issue changes scope from the attacker's authenticated context to the victim's browser session. Because AEM authors and administrators frequently preview or edit content, injected payloads can target users with higher privileges than the original attacker.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Form field values submitted by low-privileged users are stored without sufficient output encoding. When the field is later rendered, the browser interprets the stored payload as executable script rather than data.

Attack Vector

Exploitation requires network access to an authenticated AEM interface and low-level privileges to submit or edit form content. The attacker plants a JavaScript payload inside a vulnerable form field. When a victim browses to the affected page, the browser executes the payload under the origin of the AEM instance. Typical outcomes include session token theft, forced actions against the AEM API, and phishing overlays. User interaction (loading the page) is required.

No public proof-of-concept is available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-47073

Indicators of Compromise

Form field content in the AEM JCR repository containing <script>, javascript:, onerror=, or onload= handlers.
Unexpected outbound requests from author or publish instances to attacker-controlled domains following page rendering.
Session cookies or CSRF tokens appearing in web server referer or query string logs.
Content modifications to form components by low-privileged accounts outside of normal authoring workflows.

Detection Strategies

Query the AEM repository for form field properties containing HTML tag characters or JavaScript event handler patterns.
Enable and review AEM audit logs for cq:Page and form component modifications by non-administrative users.
Deploy a web application firewall rule set that flags script-like payloads posted to /content/forms/ endpoints.
Correlate authentication logs with content-creation events to identify accounts submitting unusual field values.

Monitoring Recommendations

Alert on new or modified form components created by accounts with author-level or lower permissions.
Monitor browser Content Security Policy (CSP) violation reports for inline script blocks originating from AEM-hosted pages.
Track spikes in requests to /libs/granite/security/ or session management endpoints from AEM origin pages.

How to Mitigate CVE-2025-47073

Immediate Actions Required

Upgrade Adobe Experience Manager on-premises to a version later than 6.5.22 as directed in Adobe Security Advisory APSB25-48.
Confirm AEM Cloud Service instances are running the current Adobe-managed release.
Audit user accounts with content authoring privileges and remove unnecessary access.
Review recently modified form components for script content and revert suspicious changes.

Patch Information

Adobe published fixes for CVE-2025-47073 in security bulletin APSB25-48 on June 10, 2025. Administrators of self-managed AEM should apply the corresponding service pack or hotfix. Adobe deploys AEM Cloud Service fixes automatically. Full remediation guidance is available in the Adobe Security Advisory APSB25-48.

Workarounds

Enforce a strict Content Security Policy that blocks inline scripts and disallows unsafe-inline on AEM-delivered pages.
Restrict form authoring permissions to trusted users until patches are applied.
Place a web application firewall in front of AEM to filter script tags and JavaScript event handlers in form submissions.
Increase review requirements for content publish workflows involving form components.

bash

# Example Content Security Policy header for AEM dispatcher
# Add to dispatcher or web server configuration
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"