CVE-2026-47941 Overview
CVE-2026-47941 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM). The flaw exists in vulnerable form fields where input is rendered without sufficient sanitization. A low-privileged authenticated attacker can inject malicious JavaScript that executes in a victim's browser when the affected page is loaded. The scope is changed, meaning the impact extends beyond the vulnerable component to other resources. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Authenticated attackers can inject persistent JavaScript into AEM form fields, leading to session hijacking, credential theft, and unauthorized actions executed in the context of victim users.
Affected Products
- Adobe Experience Manager 6.5.24 and earlier
- Adobe Experience Manager LTS SP1 and earlier
- Adobe Experience Manager 2026.04 and earlier (including AEM Cloud Service)
Discovery Timeline
- 2026-06-09 - CVE-2026-47941 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-47941
Vulnerability Analysis
The vulnerability resides in form field handling within Adobe Experience Manager. User-supplied input submitted through affected form fields is stored by the application and later rendered in HTML responses without proper output encoding. When a victim navigates to a page containing the tainted field, the injected payload executes within the browser's trust context for the AEM origin.
Because the CVSS vector indicates a scope change, the injected script can affect resources beyond the vulnerable form component itself. This expands the blast radius to include any authenticated session active in the victim's browser, including administrative interfaces if an authoring user views the affected page. User interaction is required because the victim must visit the page containing the stored payload.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. AEM stores attacker-controlled markup verbatim and reflects it back into the rendered DOM without context-appropriate encoding. This allows <script> tags, event handlers, and other JavaScript execution vectors to persist in the content repository and execute on retrieval.
Attack Vector
Exploitation requires the attacker to hold a low-privileged AEM account with permission to submit content into the vulnerable form field. The attacker injects a JavaScript payload into the field and saves the entry. When any subsequent user, including higher-privileged authors or administrators, browses to the page containing the field, the payload executes in their session. The attacker can then exfiltrate cookies, perform CSRF actions against AEM APIs, or pivot to escalate privileges within the authoring environment.
No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Adobe Security Bulletin APSB26-56 for vendor-supplied technical details.
Detection Methods for CVE-2026-47941
Indicators of Compromise
- Unexpected <script> tags, javascript: URIs, or DOM event handlers (onerror, onload, onmouseover) persisted in AEM content nodes or form submission records.
- Outbound HTTP requests from authoring user browsers to attacker-controlled domains shortly after loading specific AEM pages.
- Unusual session token activity or API calls originating from elevated AEM accounts immediately following navigation to user-generated form pages.
Detection Strategies
- Audit JCR (Java Content Repository) nodes that store form submissions for HTML-encoded payloads and script-like patterns.
- Inspect AEM request.log and access.log entries for POST requests to form endpoints containing encoded or raw script payloads.
- Deploy Content Security Policy (CSP) report-only headers to surface attempted inline script execution on AEM-rendered pages.
Monitoring Recommendations
- Monitor low-privileged AEM user accounts for anomalous form submission volume or content patterns containing HTML tags.
- Correlate browser-side errors and CSP violation reports with the AEM pages and accounts that produced the stored content.
- Track privileged authoring session activity for unexpected administrative API calls following page views of user-generated content.
How to Mitigate CVE-2026-47941
Immediate Actions Required
- Apply the security updates referenced in Adobe Security Bulletin APSB26-56 to all on-premises AEM 6.5 and LTS instances.
- Verify that AEM as a Cloud Service environments have received the 2026.05 or later release containing the fix.
- Review and sanitize existing form field content created prior to patching to remove any persisted script payloads.
Patch Information
Adobe released fixed versions addressing CVE-2026-47941 in Security Bulletin APSB26-56. Customers running AEM 6.5.24, AEM LTS SP1, or AEM 2026.04 and earlier should upgrade to the patched release identified in the advisory. AEM as a Cloud Service customers receive the fix through Adobe's managed update channel.
Workarounds
- Restrict permissions on form-authoring components so that only trusted users can submit content rendered to broader audiences.
- Deploy a strict Content Security Policy that disallows inline script execution and restricts script sources to known-good origins.
- Place a web application firewall in front of AEM with rules that block HTML and JavaScript patterns in form submission parameters until patching is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
