CVE-2025-47094: Adobe Experience Manager XSS Vulnerability

CVE-2025-47094 Overview

CVE-2025-47094 is a reflected Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.22 and earlier, including AEM Cloud Service builds. An attacker who convinces a victim to visit a crafted URL referencing a vulnerable page can execute arbitrary JavaScript in the victim's browser session. The flaw is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Exploitation requires user interaction and no privileges, and the injected script runs in the security context of the AEM origin. This allows attackers to steal session tokens, perform actions on behalf of authenticated authors, or deliver secondary payloads.

Critical Impact
Successful exploitation enables session theft, credential harvesting, and unauthorized actions within the AEM author or publish instance under the victim's identity.

Affected Products

Adobe Experience Manager 6.5.22 and earlier (on-premises)
Adobe Experience Manager Cloud Service (affected builds prior to fix)
AEM Forms deployments running on affected AEM versions

Discovery Timeline

2025-06-10 - CVE-2025-47094 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47094

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in Adobe Experience Manager. AEM fails to properly neutralize user-controlled input before including it in dynamically generated HTML responses. When a user visits a URL containing malicious script payloads in query parameters or path segments referencing the vulnerable page, the server reflects the unsanitized content back into the response body.

The browser then parses the reflected input as executable JavaScript within the AEM origin. Because the payload executes in the victim's authenticated context, attackers can read Cookie values not marked HttpOnly, invoke authenticated API endpoints, and manipulate content in the Digital Asset Manager or Sites console.

The scope change indicates the injected script can affect resources beyond the vulnerable component's security boundary, such as parent frames or same-origin subresources. AEM's role as a content management platform makes author accounts high-value targets.

Root Cause

The root cause is missing or insufficient output encoding on a reflected parameter in an AEM page handler. Input arriving through the request is written into an HTML context without HTML-entity encoding or context-aware escaping, allowing <script> tags and event handler attributes to break out of the intended data context.

Attack Vector

Exploitation follows a standard reflected XSS pattern. The attacker crafts a URL pointing to the vulnerable AEM endpoint with a malicious JavaScript payload embedded in a parameter. The attacker delivers the link through phishing email, malicious advertising, or an untrusted referrer. When an authenticated AEM author clicks the link, the payload executes with the author's privileges. Adobe has not published detailed exploitation code; refer to the Adobe Security Bulletin APSB25-48 for the official advisory.

Detection Methods for CVE-2025-47094

Indicators of Compromise

HTTP request logs containing URL-encoded <script>, javascript:, or onerror= patterns targeting AEM endpoints
Unexpected outbound requests from authoring browsers to attacker-controlled domains shortly after clicking external links
Referer headers from untrusted origins preceding AEM author session activity
Anomalous content modifications or asset uploads performed by legitimate author accounts outside business hours

Detection Strategies

Deploy web application firewall rules that inspect query strings and path segments for reflected XSS signatures targeting AEM URIs such as /content/, /etc/, and /libs/
Enable AEM Dispatcher logging with full query-string capture and forward logs to a centralized platform for pattern analysis
Correlate author session activity with preceding HTTP referrers to identify social-engineering-driven exploitation

Monitoring Recommendations

Monitor AEM access logs for high-entropy query parameter values or encoded script fragments
Alert on Content-Security-Policy (CSP) violation reports from author and publish instances
Track browser console error telemetry from managed author workstations for unexpected script execution

How to Mitigate CVE-2025-47094

Immediate Actions Required

Apply the Adobe security update referenced in APSB25-48 to all AEM instances at version 6.5.22 and earlier
Verify AEM Cloud Service tenants are running a build that includes the fix
Rotate author and administrator session credentials if suspicious activity is observed in access logs

Patch Information

Adobe released the fix in the June 2025 AEM security update. Administrators running AEM 6.5.x should upgrade to the latest service pack that supersedes 6.5.22. AEM as a Cloud Service customers receive the patch through the standard release pipeline. Consult the Adobe Experience Manager Advisory for exact build numbers.

Workarounds

Enforce a strict Content-Security-Policy header on AEM publish and author instances to restrict inline script execution
Configure the AEM Dispatcher to block requests containing suspicious characters such as <, >, and %3C in query parameters where not required
Restrict author instance exposure to trusted networks and require VPN access for content editors
Train content authors to avoid clicking untrusted links while authenticated to AEM

bash

# Example AEM Dispatcher filter rule to block reflected script payloads
/0100 { /type "deny" /url '*<script*' }
/0101 { /type "deny" /url '*javascript:*' }
/0102 { /type "deny" /url '*%3Cscript*' }