CVE-2026-47949: Adobe Experience Manager XSS Vulnerability

CVE-2026-47949 Overview

CVE-2026-47949 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, 2026.04, and earlier releases. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. When a victim browses to the affected page, the script executes in the victim's browser context. The vulnerability has a changed scope, meaning the impact extends beyond the vulnerable component. Adobe published the issue in security bulletin APSB26-56. The flaw is classified under [CWE-79] for improper neutralization of input during web page generation.

Critical Impact
Authenticated attackers can persist malicious scripts in AEM form fields, executing arbitrary JavaScript in victim browsers with cross-origin impact due to changed scope.

Affected Products

Adobe Experience Manager 6.5.24 and earlier
Adobe Experience Manager LTS SP1
Adobe Experience Manager 2026.04 and earlier (AEM Cloud Service)

Discovery Timeline

2026-06-09 - CVE-2026-47949 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47949

Vulnerability Analysis

The vulnerability resides in Adobe Experience Manager's handling of input within form fields. AEM fails to properly neutralize user-supplied content before storing and rendering it back to other users. When a low-privileged authenticated user submits crafted JavaScript payloads, the application persists the malicious content. Subsequent visitors loading the affected page trigger script execution in their browser session.

The scope change indicates the vulnerable component and the impacted component differ. An attacker exploiting the form field can affect resources beyond AEM itself, such as other origins or authenticated sessions accessible to the victim. User interaction is required, as the victim must navigate to the page containing the injected payload.

The issue maps to [CWE-79], Improper Neutralization of Input During Web Page Generation. EPSS data published 2026-06-11 indicates a low likelihood of near-term exploitation, but the persistence of stored XSS payloads makes detection critical for environments hosting authenticated content authoring workflows.

Root Cause

The root cause is missing or insufficient output encoding when rendering content submitted through form fields. AEM does not sanitize HTML entities or strip script-bearing attributes before storing the data in the repository. When templates render the stored value, the browser parses injected <script> tags or event handler attributes as executable code.

Attack Vector

The attack vector is network-based and requires authentication with at least content contributor privileges. An attacker submits a payload through a vulnerable form field exposed in the AEM authoring or publishing interface. The payload persists in the content repository. When an administrator or another user views the affected page, the injected JavaScript runs under the victim's authenticated session, enabling session token theft, forced actions, or pivoting into adjacent applications.

No verified public exploit code is available for this CVE. Refer to the Adobe Experience Manager Security Advisory APSB26-56 for vendor technical details.

Detection Methods for CVE-2026-47949

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or on* event handler attributes stored in AEM form field values within the JCR repository.
Outbound HTTP requests from authenticated user sessions to attacker-controlled domains following AEM page visits.
Browser console errors or Content Security Policy violations originating from AEM-hosted pages.

Detection Strategies

Scan the JCR repository and content nodes for stored values containing HTML or JavaScript syntax in fields expected to hold plain text.
Review AEM access logs for POST requests to form submission endpoints containing encoded script payloads such as %3Cscript%3E or onerror=.
Correlate authoring user activity with subsequent anomalous client-side behavior reported by victim browsers.

Monitoring Recommendations

Enable verbose request logging on AEM dispatcher and publisher instances to capture form submission payloads.
Deploy a Content Security Policy with script-src restrictions and alert on CSP violation reports.
Monitor low-privileged authoring accounts for unusual content modification volume or off-hours activity.

How to Mitigate CVE-2026-47949

Immediate Actions Required

Apply the Adobe security updates referenced in bulletin APSB26-56 to AEM 6.5, LTS SP1, and AEM Cloud Service 2026.04 instances.
Audit existing form content in the JCR repository for previously injected payloads and remove malicious entries.
Restrict authoring privileges and review the membership of content contributor groups to enforce least privilege.

Patch Information

Adobe addressed CVE-2026-47949 in the updates documented in the Adobe Experience Manager Security Advisory APSB26-56. Customers on AEM Cloud Service receive fixes through the managed update cycle. On-premise AEM 6.5 and LTS deployments require manual installation of the corresponding service pack or hotfix.

Workarounds

Configure AEM dispatcher rules to filter form submissions containing HTML tags or script syntax until patches are applied.
Enforce a strict Content Security Policy that disallows inline scripts and limits script sources to trusted origins.
Temporarily disable or restrict access to vulnerable form components on production publish instances.

bash

# Example dispatcher filter rule to block script payloads in form parameters
/0100 { /type "deny" /method "POST" /url "*" /query "*<script*" }
/0101 { /type "deny" /method "POST" /url "*" /query "*javascript:*" }