CVE-2026-47948: Adobe Experience Manager XSS Vulnerability

CVE-2026-47948 Overview

CVE-2026-47948 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, 2026.04, and earlier. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they navigate to a page containing the affected field. The vulnerability has a changed scope, meaning the impact extends beyond the vulnerable component itself. Adobe assigned the issue to weakness class [CWE-79] and published advisory APSB26-56 to address it. Exploitation requires user interaction, which limits drive-by attack scenarios.

Critical Impact
Authenticated attackers can persist malicious JavaScript in AEM-rendered pages, enabling session theft, credential harvesting, and lateral access to administrative interfaces under a changed security scope.

Affected Products

Adobe Experience Manager 6.5.24 and earlier
Adobe Experience Manager LTS SP1 (6.5 LTS branch)
Adobe Experience Manager Cloud Service release 2026.04 and earlier

Discovery Timeline

2026-06-09 - CVE-2026-47948 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47948

Vulnerability Analysis

The flaw is a stored XSS in Adobe Experience Manager form-handling components. Adobe Experience Manager is a content management and digital experience platform used to publish web content, forms, and assets. The vulnerable code path accepts user-supplied input through form fields and persists it without sufficient output encoding or input sanitization. When a victim renders a page that references the stored value, the browser parses attacker-controlled markup as executable script.

Because the CVSS vector reports a changed scope (S:C), script execution affects security boundaries beyond the vulnerable component. In practice this often means the injected script runs in the context of an authoring or administrative interface that trusts the rendered field. The confidentiality and integrity impacts are both Low, consistent with browser-side data theft rather than direct server compromise.

Root Cause

The root cause is improper neutralization of input during web page generation, classified as [CWE-79]. Form-field values supplied by low-privileged users are stored in the repository and later reflected into HTML responses without context-appropriate escaping. AEM template rendering should HTML-encode untrusted strings for element content and attribute contexts, but the affected component fails to do so consistently.

Attack Vector

The attack proceeds over the network and requires a low-privileged account, such as a contributor or form author. The attacker submits a form field containing a crafted JavaScript payload. The payload is persisted to the AEM repository. When any authenticated victim, including higher-privileged authors or administrators, browses to a page that renders the field, the script executes in their browser session. No public proof-of-concept exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is publicly available. Refer to the Adobe Security Advisory APSB26-56 for vendor-supplied technical details.

Detection Methods for CVE-2026-47948

Indicators of Compromise

Form-field values stored in the AEM JCR repository containing <script>, javascript:, onerror=, onload=, or other HTML event-handler tokens.
Unexpected outbound browser requests from author or publish instances to attacker-controlled domains following page rendering.
Author account sessions issuing administrative API calls that do not match the user's normal workflow pattern.

Detection Strategies

Audit JCR content nodes for stored markup in text and form properties using AEM Query Builder or Oak queries scoped to recently modified content.
Inspect web server and dispatcher logs for HTTP POST requests to form-submission endpoints containing encoded script payloads.
Monitor browser Content Security Policy violation reports from author and publish environments for inline script blocks executed from rendered form fields.

Monitoring Recommendations

Enable verbose request logging on AEM author instances and forward events to a centralized analytics platform for correlation against authoring user behavior baselines.
Track privilege-tier account activity, especially session reuse, token issuance, and configuration changes immediately after a contributor user submits form content.
Alert on creation or modification of content nodes by low-privileged accounts that contain HTML or JavaScript syntax in fields expected to hold plain text.

How to Mitigate CVE-2026-47948

Immediate Actions Required

Apply the updates listed in Adobe Security Advisory APSB26-56 to all AEM 6.5, LTS, and Cloud Service instances.
Review and reduce privileges for accounts that can submit content through forms, removing unnecessary author or contributor permissions.
Audit existing form-field content created since the last known-good backup for persisted script payloads and remove malicious entries.

Patch Information

Adobe released fixes in advisory APSB26-56 covering Adobe Experience Manager 6.5.24, the LTS branch beyond SP1, and Cloud Service release 2026.04. Customers running AEM as a Cloud Service receive the update through the standard release channel. On-premises customers must install the corresponding service pack or hotfix referenced in the advisory.

Workarounds

Deploy a Content Security Policy that disallows inline scripts (script-src 'self') on author and publish instances to reduce execution of injected payloads.
Configure the AEM Dispatcher to filter request parameters containing HTML or JavaScript syntax before they reach the publish tier.
Enforce stricter Sling input validation on custom form components by HTML-encoding output through xssAPI.encodeForHTML() until the patch is deployed.

bash

# Example AEM Dispatcher filter rule to drop suspicious form payloads
/0100 { /type "deny" /url '*<script*' }
/0101 { /type "deny" /url '*javascript:*' }
/0102 { /type "deny" /url '*onerror=*' }