CVE-2026-47944: Adobe Experience Manager XSS Vulnerability

CVE-2026-47944 Overview

CVE-2026-47944 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, 2026.04, and earlier releases. The flaw resides in vulnerable form fields that fail to sanitize attacker-supplied input. A low-privileged authenticated attacker can inject malicious JavaScript into these fields. The payload executes in a victim's browser when the user navigates to the affected page. The vulnerability has a changed scope, meaning the impact extends beyond the vulnerable component itself. Adobe classifies the issue under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Stored XSS enables session hijacking, credential theft, and unauthorized actions executed in the context of any authenticated AEM user viewing the affected page.

Affected Products

Adobe Experience Manager 6.5.24 and earlier
Adobe Experience Manager LTS SP1 and earlier
Adobe Experience Manager Cloud Service release 2026.04 and earlier

Discovery Timeline

2026-06-09 - CVE-2026-47944 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47944

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input in AEM form field components. When an authenticated low-privileged user submits content containing JavaScript payloads, AEM persists the input without adequate output encoding. The stored payload later renders directly within the HTML response served to other users. Because the scope is changed, code executing in the victim's browser can affect resources outside the original security context of the AEM component. This expands the blast radius to include session tokens, authenticated API calls, and content other users can access. The EPSS score of 0.03% reflects low predicted exploitation likelihood, but the persistent nature of stored XSS makes the flaw attractive for targeted attacks against AEM-authoring environments.

Root Cause

The root cause is insufficient input validation and output encoding within form field handling routines in AEM. User content reaches the rendered DOM without the contextual escaping required to neutralize active scripting constructs.

Attack Vector

Exploitation requires network access to an AEM instance and a valid low-privileged account, such as a contributor or author role. The attacker submits crafted input through an affected form field. User interaction is required: a victim, typically an administrator or editor, must browse to the page that renders the stored payload. Once the page loads, the injected JavaScript runs with the privileges of the victim's session.

No verified public proof-of-concept code is available for this vulnerability. Refer to the Adobe Security Bulletin APSB26-56 for vendor-supplied technical details.

Detection Methods for CVE-2026-47944

Indicators of Compromise

Unexpected <script>, onerror, onload, or javascript: strings persisted in AEM JCR nodes corresponding to form field properties.
Outbound HTTP requests from author or publish instances to attacker-controlled domains following page rendering.
Anomalous session token exfiltration patterns or session reuse from unexpected geographies after AEM page views.

Detection Strategies

Audit JCR repository content for form field properties containing HTML or script tags using AEM Query Builder or JCR-SQL2 queries.
Inspect HTTP responses for unencoded angle brackets or event handler attributes within form field render output.
Correlate low-privileged user content submissions with subsequent administrator page visits in access logs.

Monitoring Recommendations

Enable AEM access logging at the dispatcher and publish tiers, and forward logs to a centralized analytics platform.
Monitor Content Security Policy (CSP) violation reports for inline script execution attempts on AEM-served pages.
Alert on creation or modification of nodes by accounts with contributor or author roles that contain HTML markup in text properties.

How to Mitigate CVE-2026-47944

Immediate Actions Required

Apply the Adobe security update referenced in APSB26-56 to all affected AEM 6.5, LTS, and Cloud Service instances.
Review accounts with contributor and author privileges, and revoke unnecessary access to form authoring components.
Audit existing form field content for previously injected payloads and sanitize or remove suspect entries.

Patch Information

Adobe published security bulletin APSB26-56 addressing this vulnerability. Customers running AEM 6.5.24 or earlier should upgrade to the patched service pack. AEM Cloud Service customers on release 2026.04 or earlier should update to the latest release. Refer to the Adobe Experience Manager Security Advisory for exact version mappings.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Restrict access to form authoring components to trusted users until patches are applied.
Configure the AEM dispatcher to filter responses containing suspicious script patterns when business requirements allow.

bash

# Example CSP response header for AEM dispatcher configuration
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"