CVE-2025-54272: Adobe Experience Manager XSS Vulnerability

CVE-2025-54272 Overview

CVE-2025-54272 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 11.6 and earlier. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they visit a page containing the affected field. Exploitation requires user interaction, specifically the victim opening a malicious link. The scope is changed, meaning the injected script can impact resources beyond the vulnerable component's security authority. The issue is tracked under CWE-79 and is addressed in Adobe Security Advisory APSB25-98.

Critical Impact

An authenticated attacker can persist JavaScript in AEM form fields, hijacking sessions or performing actions in the victim's browser context when the malicious page is loaded.

Affected Products

• Adobe Experience Manager 6.5.22.0 with Feature Pack fp11.6
• Adobe Experience Manager versions 11.6 and earlier
• Adobe Experience Manager Screens (per advisory APSB25-98)

Discovery Timeline

• 2025-10-14 - CVE-2025-54272 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54272

Vulnerability Analysis

The flaw is a stored Cross-Site Scripting weakness classified under CWE-79. Adobe Experience Manager fails to properly neutralize user-supplied input written to specific form fields. An authenticated attacker with low privileges can persist a JavaScript payload in the application's storage layer. Any subsequent visitor rendering the affected page executes the attacker-controlled script in their browser session. Because the vulnerability has a changed scope, the injected script can reach data or functionality outside the vulnerable component's original security boundary, including administrative sessions if a privileged user visits the malicious content.

Root Cause

The root cause is insufficient output encoding and input sanitization on values written to form field storage within AEM. When the affected fields are rendered back to a browser, HTML and JavaScript metacharacters are not consistently escaped. This allows <script> tags and event-handler attributes supplied by an attacker to be interpreted as executable content by the browser rather than treated as inert text.

Attack Vector

Exploitation is network-based and requires the attacker to hold a low-privileged AEM account with permission to submit or edit content in a vulnerable form field. The attacker stores a crafted payload, then delivers a link to a victim through phishing or another social channel. When the victim opens the link and the browser renders the field, the payload executes with the victim's session privileges. Because user interaction is required, the vector depends on successful social engineering rather than pure remote triggering. See the Adobe Security Advisory APSB25-98 for vendor-authored technical detail.

Detection Methods for CVE-2025-54272

Indicators of Compromise

• Form field content containing <script>, onerror=, onload=, or javascript: sequences stored in AEM repositories.
• Outbound requests from AEM author or publish instances to attacker-controlled domains initiated via rendered pages.
• Unexpected session token, cookie, or credential exfiltration traffic originating from browsers that rendered AEM pages.

Detection Strategies

• Query the AEM content repository (JCR) for nodes and property values containing script tags or HTML event handlers written by low-privileged accounts.
• Inspect web server and CDN logs for URLs that consistently reference the same form-driven pages preceding user browser anomalies.
• Correlate authenticated content-authoring events with subsequent client-side error reports or Content Security Policy (CSP) violations.

Monitoring Recommendations

• Enable and forward AEM access, dispatcher, and audit logs to a centralized analytics platform for continuous review.
• Deploy a strict Content Security Policy on AEM-published sites and monitor report-uri violations for injection attempts.
• Alert on new or modified form field values submitted by accounts that do not normally author content.

How to Mitigate CVE-2025-54272

Immediate Actions Required

• Apply the update referenced in Adobe Security Advisory APSB25-98 to all AEM instances at version 11.6 or earlier.
• Audit user accounts with content-authoring privileges and revoke access that is not operationally required.
• Review recently modified form field content for embedded scripts and remove malicious entries.

Patch Information

Adobe released fixes for this vulnerability in the security bulletin APSB25-98. Administrators should install the updated AEM Screens release identified in the vendor advisory and validate that the affected package is upgraded past version 11.6.

Workarounds

• Enforce a restrictive Content Security Policy that disallows inline scripts and untrusted script sources on AEM-delivered pages.
• Restrict form-authoring permissions to a minimal set of trusted users until the patch is deployed.
• Configure the AEM dispatcher to filter or reject requests containing script markup in form-submission parameters.

# Example Content Security Policy header for AEM publish tier
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report"