CVE-2025-47092: Adobe Experience Manager XSS Vulnerability

CVE-2025-47092 Overview

CVE-2025-47092 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM). The flaw affects AEM versions 6.5.22 and earlier, along with AEM Cloud Service deployments. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they load the page containing the affected field. The vulnerability requires user interaction and results in a scope change, allowing attackers to affect resources beyond the vulnerable component. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact

Authenticated attackers can inject persistent JavaScript into AEM form fields, enabling session hijacking, credential theft, and unauthorized actions performed in the victim's browser context.

Affected Products

• Adobe Experience Manager 6.5.22 and earlier (on-premise)
• Adobe Experience Manager Cloud Service
• AEM form components accepting user-supplied field content

Discovery Timeline

• 2025-06-10 - CVE-2025-47092 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47092

Vulnerability Analysis

The vulnerability is a stored XSS flaw in Adobe Experience Manager form field handling. Stored XSS differs from reflected variants because the malicious payload persists in the application's backend storage. Every user who subsequently loads the affected page executes the attacker's script.

An attacker with low privileges, such as an authenticated content author, can submit crafted input into a form field. AEM fails to properly neutralize script content before rendering the field value in the resulting HTML. The browser then interprets the injected content as executable JavaScript. Because the attack results in a scope change, injected scripts can access resources outside the vulnerable component, including cookies and tokens for adjacent applications on the same origin.

Root Cause

The root cause is improper output encoding of user-controlled data placed into form fields. AEM renders the stored field content into an HTML context without sanitizing or escaping characters such as <, >, and quote marks. Adobe addressed the issue in patch bundle APSB25-48 by adding proper contextual output encoding.

Attack Vector

Exploitation requires network access to the AEM authoring or delivery instance and low-privileged credentials. The attacker submits a payload containing JavaScript, such as a <script> tag or an event handler on an HTML element, into a form field. AEM stores the payload. When a victim, including administrators or site visitors, browses to the page containing the field, the script executes in the victim's browser. The attacker can then exfiltrate session cookies, perform actions on behalf of the victim, or pivot to other resources sharing the origin.

No verified public exploit code is available. For technical details, refer to the Adobe Security Patch APSB25-48 advisory.

Detection Methods for CVE-2025-47092

Indicators of Compromise

• Form field content in AEM repositories containing HTML tags such as <script>, <img onerror=>, or <svg onload=>.
• Outbound HTTP requests from authoring or delivery hosts to unexpected external domains, indicating cookie or token exfiltration.
• Unexpected DOM modifications or third-party script loads on published pages during runtime inspection.
• Audit log entries showing form field updates by low-privileged accounts followed by page renders returning unusual response sizes.

Detection Strategies

• Query the AEM Java Content Repository (JCR) for field property values containing script markers or JavaScript event handler substrings.
• Deploy a Content Security Policy (CSP) in report-only mode to surface inline script violations on delivery instances.
• Correlate authoring activity logs with subsequent anomalous browser telemetry from users who accessed the same content paths.

Monitoring Recommendations

• Enable and forward AEM audit.log and request.log entries to a central SIEM for review of authoring events.
• Monitor web application firewall (WAF) logs for POST bodies containing encoded script payloads targeting AEM form endpoints.
• Track privileged account access to authoring instances and alert on script content stored by non-administrative roles.

How to Mitigate CVE-2025-47092

Immediate Actions Required

• Apply the Adobe Experience Manager security update referenced in APSB25-48 to all on-premise and Cloud Service instances.
• Audit existing form field content for previously injected payloads and remove any malicious entries.
• Rotate session tokens and administrative credentials that may have been exposed to affected pages.
• Restrict authoring access to the minimum set of users required for content operations.

Patch Information

Adobe released fixes for CVE-2025-47092 as part of security bulletin APSB25-48. Upgrade AEM on-premise deployments beyond version 6.5.22 and ensure AEM Cloud Service instances are running the patched release. Refer to the Adobe Security Patch APSB25-48 bulletin for exact version numbers and installation guidance.

Workarounds

• Deploy a strict Content Security Policy that disallows inline scripts on AEM-delivered pages to reduce exploit impact.
• Configure a WAF rule set to inspect and block HTML and JavaScript payloads submitted to AEM form endpoints.
• Temporarily restrict form authoring privileges to a small group of trusted users until patching completes.

# Example Content Security Policy header for AEM Dispatcher configuration
Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-{RANDOM}'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"