CVE-2026-47947: Adobe Experience Manager XSS Vulnerability

CVE-2026-47947 Overview

CVE-2026-47947 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM). The flaw impacts AEM versions 6.5.24, LTS SP1, 2026.04, and earlier releases, including AEM Cloud Service deployments. Attackers can manipulate the Document Object Model (DOM) to execute arbitrary JavaScript in a victim's browser session. Exploitation requires user interaction, specifically a victim visiting an attacker-crafted webpage. The vulnerability is tracked under [CWE-79] and carries a changed scope, meaning the impact extends beyond the vulnerable component. Adobe published the corresponding fix in security bulletin APSB26-56.

Critical Impact
An authenticated attacker can execute malicious JavaScript in the victim's browser context, leading to session compromise, data theft, or unauthorized actions within the AEM interface.

Affected Products

Adobe Experience Manager 6.5.24 and earlier
Adobe Experience Manager LTS SP1 and earlier
Adobe Experience Manager 2026.04 and earlier (including AEM Cloud Service)

Discovery Timeline

2026-06-09 - CVE-2026-47947 published to the National Vulnerability Database (NVD)
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47947

Vulnerability Analysis

The vulnerability resides in client-side JavaScript executed within Adobe Experience Manager interfaces. DOM-based XSS occurs when JavaScript reads attacker-controllable data from a source such as location.hash, document.referrer, or window.name, then writes it to a dangerous sink such as innerHTML, document.write, or eval. The unsanitized flow allows injected script tags or event handlers to execute in the victim's browser. Because the scope is changed, the executed JavaScript can affect resources beyond the vulnerable AEM component, including authenticated user sessions and adjacent application contexts. Successful exploitation enables session hijacking, credential theft via phishing overlays, and unauthorized actions against the AEM author or publish instance.

Root Cause

The root cause is improper neutralization of user-controlled input during web page generation on the client side, classified under [CWE-79]. AEM client-side scripts process attacker-supplied data without sufficient encoding before inserting it into the DOM. The absence of contextual output encoding and the use of unsafe DOM sinks enable script execution within the trusted origin of the AEM application.

Attack Vector

Exploitation is network-based and requires low-privilege authentication along with user interaction. An attacker with low-level access crafts a malicious URL containing a DOM payload, then convinces an authenticated AEM user to visit the link. When the victim loads the crafted page, the vulnerable client-side code parses the payload and executes the attacker's JavaScript in the AEM origin context. See the Adobe Security Bulletin APSB26-56 for technical details.

Detection Methods for CVE-2026-47947

Indicators of Compromise

Unusual URL parameters or URL fragments containing JavaScript keywords such as <script>, javascript:, onerror=, or onload= in AEM access logs.
HTTP referrers from external domains immediately preceding sensitive AEM author actions.
Outbound requests from AEM user sessions to unknown domains containing session tokens or cookies.

Detection Strategies

Inspect AEM dispatcher and web server logs for requests containing encoded JavaScript payloads in query strings, fragments, or path parameters.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution and unauthorized script sources.
Correlate AEM authentication events with anomalous outbound traffic to flag potential session exfiltration following XSS execution.

Monitoring Recommendations

Monitor AEM author and publish endpoints for spikes in 4xx responses tied to malformed input parameters.
Alert on AEM administrative actions originating from sessions that loaded external referrers within a short time window.
Track browser console errors reported by users that may indicate failed or partial XSS payload execution.

How to Mitigate CVE-2026-47947

Immediate Actions Required

Apply the Adobe security updates referenced in APSB26-56 to all on-premises AEM 6.5 and LTS instances.
Confirm AEM Cloud Service tenants have received the vendor-managed patch for the 2026.04 release branch.
Restrict AEM author interface access to trusted networks and authenticated administrators only.

Patch Information

Adobe released fixed builds for Adobe Experience Manager 6.5.25, LTS SP2, and the 2026.05 Cloud Service release. Customers must upgrade to a version later than 6.5.24, LTS SP1, or 2026.04 as documented in the Adobe Security Bulletin APSB26-56.

Workarounds

Deploy a strict Content Security Policy on AEM author and publish instances to block inline scripts and untrusted script sources.
Configure the AEM dispatcher to reject requests containing suspicious URL fragments, query parameters, or encoded script tags.
Train AEM authors and administrators to avoid clicking unsolicited links that reference internal AEM URLs.

bash

# Example AEM dispatcher filter to block common XSS payload patterns
/0100 { /type "deny" /url '*<script*' }
/0101 { /type "deny" /url '*javascript:*' }
/0102 { /type "deny" /url '*onerror=*' }
/0103 { /type "deny" /url '*onload=*' }