CVE-2025-47075: Adobe Experience Manager XSS Vulnerability

CVE-2025-47075 Overview

CVE-2025-47075 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. When a victim browses to the page containing the injected payload, the script executes in the victim's browser context. The flaw is tracked under [CWE-79] and impacts both AEM on-premise and AEM Cloud Service deployments. Adobe addressed the issue in security advisory APSB25-48.

Critical Impact

Authenticated attackers can inject persistent JavaScript into AEM form fields, enabling session hijacking, credential theft, and unauthorized actions performed under a victim's browser context.

Affected Products

• Adobe Experience Manager 6.5.22 and earlier (on-premise)
• Adobe Experience Manager Cloud Service (affected releases prior to the APSB25-48 fix)
• AEM deployments exposing form authoring or content editing to low-privileged users

Discovery Timeline

• 2025-06-10 - CVE-2025-47075 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47075

Vulnerability Analysis

The vulnerability is a stored XSS flaw in Adobe Experience Manager form field handling. AEM stores user-supplied input from form fields and later renders that input in page markup without sufficient output encoding. An attacker with low-privilege access to authoring or form-editing capabilities can persist a malicious payload inside a form field. When another user browses to the page containing the field, the browser parses and executes the attacker-controlled script.

The scope is marked as changed, indicating the injected script can affect resources beyond the vulnerable component. Because the payload executes in the victim's authenticated session, an attacker can read Document Object Model (DOM) content, exfiltrate session tokens, or trigger authenticated requests on behalf of the victim.

Root Cause

The root cause is improper neutralization of input during web page generation, classified under [CWE-79]. AEM fails to sanitize or contextually encode script-bearing input submitted through affected form field components. Content stored server-side is served back to viewers as executable markup, violating the boundary between data and code.

Attack Vector

Exploitation requires network access to the AEM instance, a low-privileged authenticated account, and victim interaction to load the affected page. An attacker submits a crafted payload containing JavaScript into a vulnerable form field. The payload persists in AEM's content repository. Any authenticated user, including administrators, who visits the page containing the field triggers execution of the injected script.

No verified public exploit code is available. Refer to the Adobe Security Update APSB25-48 for vendor guidance.

Detection Methods for CVE-2025-47075

Indicators of Compromise

• Form field values in the AEM content repository containing <script>, javascript:, or event handler attributes such as onerror= and onload=.
• Unexpected outbound requests from authenticated user browsers to attacker-controlled domains following visits to AEM pages.
• Anomalous JCR (Java Content Repository) node modifications by low-privileged accounts targeting form-related components.

Detection Strategies

• Review AEM audit logs for content modifications made by low-privileged authors, focusing on form component properties.
• Scan the JCR repository for stored properties containing HTML tags, script markers, or encoded JavaScript payloads.
• Inspect web server and reverse proxy logs for suspicious POST requests to /content/* or form submission endpoints containing script fragments.

Monitoring Recommendations

• Enable Content Security Policy (CSP) reporting to surface inline script execution attempts on AEM-hosted pages.
• Alert on privilege changes or unusual authoring activity from accounts with limited AEM permissions.
• Correlate browser-side errors and CSP violations with AEM page views to identify successful stored XSS execution.

How to Mitigate CVE-2025-47075

Immediate Actions Required

• Apply the Adobe security update referenced in APSB25-48 to AEM 6.5 and validate that Cloud Service instances have received the corresponding fix.
• Audit all low-privileged author, contributor, and form-editor accounts and disable unused accounts.
• Review recently modified form components for stored script payloads and remove any suspicious content.

Patch Information

Adobe released the fix in security bulletin APSB25-48. On-premise customers should upgrade Adobe Experience Manager to the patched service pack version above 6.5.22. AEM Cloud Service customers receive the update through Adobe's managed release channel. Confirm patch application by validating the installed AEM version and reviewing the vendor advisory for the specific hotfix identifier.

Workarounds

• Restrict authoring and form-editing permissions to trusted users until the patch is applied.
• Deploy a Web Application Firewall (WAF) rule set that inspects form submissions for script tags and common XSS payload patterns.
• Enforce a strict Content Security Policy that disallows inline scripts on AEM-published pages to reduce the impact of stored payloads.

# Example CSP header to reduce stored XSS impact on AEM-published pages
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'