CVE-2025-47074: Adobe Experience Manager XSS Vulnerability

CVE-2025-47074 Overview

CVE-2025-47074 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they visit the page containing the injected field. The flaw is tracked under [CWE-79] and requires user interaction to trigger. Adobe published the fix in security bulletin APSB25-48.

Critical Impact

An authenticated attacker with low privileges can persist JavaScript payloads that run in the browser context of other AEM users, enabling session compromise, content defacement, and phishing against authoring or visitor sessions.

Affected Products

• Adobe Experience Manager 6.5.22 and earlier (on-premises)
• Adobe Experience Manager AEM Cloud Service
• Adobe Experience Manager Forms components accepting user-supplied field values

Discovery Timeline

• 2025-06-10 - CVE-2025-47074 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47074

Vulnerability Analysis

The vulnerability is a stored XSS flaw affecting Adobe Experience Manager form components. AEM fails to sanitize or encode user-supplied input before persisting it to the content repository and rendering it back to clients. When a victim loads a page containing the tainted field, the browser interprets the attacker-controlled markup as executable script.

Because the payload persists in the repository, every subsequent viewer of the affected page becomes a target. The scope changes (S:C in the CVSS vector) because script executing in an authenticated author's browser can act on AEM resources outside the attacker's original privilege boundary.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Vulnerable form field handlers accept HTML or JavaScript characters (<, >, ", event handler attributes) without contextual output encoding. AEM stores the raw values and later reflects them into rendered pages, allowing script injection into the DOM.

Attack Vector

Exploitation requires an attacker with a low-privileged authenticated account, typically one that can submit or edit content through an exposed AEM form. The attacker submits a form value containing an HTML or JavaScript payload. AEM persists the value in the JCR content repository. When any user, including higher-privileged authors or public visitors, later loads the page referencing that field, the browser executes the attacker's script.

Because user interaction is required, attackers commonly combine the flaw with social engineering or with pages that are naturally visited by administrators. Successful execution can steal session cookies, issue authenticated requests to /libs/granite or /bin endpoints, or modify content on the victim's behalf.

No public proof-of-concept, exploit code, or evidence of in-the-wild exploitation has been published. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-47074

Indicators of Compromise

• Form field values in the JCR repository containing <script>, javascript:, or inline event handlers such as onerror= and onload=.
• Unexpected outbound requests from author or publish instances to attacker-controlled domains referenced by injected scripts.
• Author or admin sessions issuing content modification requests that do not correspond to legitimate user actions.

Detection Strategies

• Query the JCR repository for property values matching HTML tag or JavaScript URI patterns across form component nodes.
• Enable and review AEM Dispatcher and access logs for anomalous POST requests to form-submission endpoints from low-privileged accounts.
• Deploy Content Security Policy (CSP) reporting to surface inline script execution attempts on published pages.

Monitoring Recommendations

• Monitor AEM audit logs for content edits performed by service or low-tier accounts that would not normally publish content.
• Alert on browser-side CSP violation reports originating from AEM-hosted domains.
• Track failed and successful authentication events for author accounts to identify credential abuse preceding injection.

How to Mitigate CVE-2025-47074

Immediate Actions Required

• Apply the Adobe security update referenced in APSB25-48 to all AEM 6.5 instances and confirm AEM Cloud Service instances are on a patched release.
• Audit form component content in the JCR repository for previously injected payloads and remove or sanitize any malicious values.
• Rotate session tokens and credentials for author accounts that may have loaded affected pages.

Patch Information

Adobe addressed CVE-2025-47074 in the Adobe Experience Manager Service Pack referenced in security bulletin APSB25-48. Upgrade AEM 6.5 to version 6.5.23 or later. AEM as a Cloud Service customers receive the fix through the standard release channel. Verify the installed version through the Web Console or the CRX package manager after applying the update.

Workarounds

• Restrict form submission and content authoring permissions to trusted users until the patch is applied.
• Configure the AEM Dispatcher to filter request parameters containing HTML control characters on public-facing form endpoints.
• Enforce a strict Content Security Policy that blocks inline script execution on pages rendering user-supplied form data.

# Example strict CSP header enforced at the Dispatcher or reverse proxy
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"