CVE-2026-47950: Adobe Experience Manager XSS Vulnerability

CVE-2026-47950 Overview

CVE-2026-47950 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM). The flaw resides in vulnerable form fields that fail to sanitize user-controlled input before rendering it back to other users. A low-privileged authenticated attacker can inject malicious JavaScript that executes in a victim's browser when they load the affected page. The vulnerability has a changed scope, meaning injected scripts can affect resources beyond the vulnerable component. Adobe addressed the issue in security advisory APSB26-56.

Critical Impact

Authenticated attackers can persist malicious JavaScript in AEM-managed content, hijacking sessions and performing actions in the context of authoring users or site visitors.

Affected Products

• Adobe Experience Manager 6.5.24 and earlier
• Adobe Experience Manager LTS SP1 and earlier
• Adobe Experience Manager 2026.04 and earlier (including AEM Cloud Service)

Discovery Timeline

• 2026-06-09 - CVE-2026-47950 published to NVD
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47950

Vulnerability Analysis

The vulnerability is classified as Cross-Site Scripting [CWE-79]. AEM accepts attacker-supplied input through form field components and stores that data within the content repository. When another user views a page that renders the stored value, AEM emits the input into the HTML response without sufficient output encoding. The browser parses the injected <script> payload as executable code rather than literal text.

Because the CVSS scope is changed, the executed JavaScript runs in a security context different from the vulnerable component. In an AEM author environment, this can allow access to administrative session cookies, the JCR repository, or replication endpoints. User interaction is required, as the victim must browse to the page containing the malicious payload.

Root Cause

The root cause is improper neutralization of input during web page generation. AEM form-field handling code stores attacker-controlled values and later writes them to the response stream without applying context-aware HTML, attribute, or JavaScript encoding. Adobe has not published the specific component path, but the flaw is consistent with missing xssAPI.encodeForHTML or equivalent encoding calls in rendering logic.

Attack Vector

Exploitation requires network access to an AEM instance and a valid low-privileged account capable of submitting or editing form-field content. The attacker injects a payload such as an HTML element with an onerror handler or an inline event handler into a form field. The payload is stored in the repository and served to every subsequent visitor of the affected page. When a higher-privileged user, such as an author or administrator, loads the page, the script executes with that user's permissions. No realCodeExamples have been published for this issue; refer to Adobe's APSB26-56 advisory for vendor guidance.

Detection Methods for CVE-2026-47950

Indicators of Compromise

• Stored content in the JCR repository containing <script>, javascript:, or inline event handlers such as onerror=, onload=, or onmouseover= within form field properties.
• Unexpected outbound HTTP requests from author or publish instances to attacker-controlled domains shortly after page renders.
• Session token reuse from unusual IP addresses following a privileged user visiting a page that contains user-submitted form content.

Detection Strategies

• Audit AEM content packages and the JCR for nodes whose string properties contain HTML tags or JavaScript schemes, focusing on form-field components.
• Enable and review Dispatcher and AEM request logs for anomalous payloads in POST parameters targeting form endpoints.
• Deploy Content Security Policy (CSP) reporting endpoints and monitor report-uri submissions for inline script violations originating from AEM-served pages.

Monitoring Recommendations

• Alert on AEM administrative actions, such as user creation or replication agent changes, that occur within the same session as a form-page render.
• Track HTTP responses from AEM containing unexpected <script> blocks not present in approved component templates.
• Correlate authentication events with browser activity to detect session hijacking attempts following XSS execution.

How to Mitigate CVE-2026-47950

Immediate Actions Required

• Apply the fixes referenced in Adobe Security Advisory APSB26-56 to all AEM 6.5, LTS, and 2026.x instances.
• Restrict form-authoring privileges to trusted users and review existing low-privileged accounts for unexpected activity.
• Audit recently modified form content for injected scripts and remove malicious payloads from the repository.

Patch Information

Adobe released remediation in advisory APSB26-56 covering AEM 6.5.24, AEM LTS SP1, and AEM 2026.04 along with AEM Cloud Service updates. Customers running on-premises versions must upgrade to the fixed service pack or hotfix release. AEM as a Cloud Service receives the fix automatically through Adobe's managed update pipeline.

Workarounds

• Enforce a strict Content Security Policy that disallows inline scripts (script-src 'self') on AEM-served pages until patching is complete.
• Place a web application firewall in front of AEM Dispatcher to filter HTML tags and JavaScript schemes from form submission parameters.
• Disable or restrict access to form-field components that accept rich-text content where business requirements permit.

# Example Dispatcher filter rule to block obvious script payloads in form POSTs
/0100 { /type "deny" /method "POST" /url "*/content/*" /query "*<script*" }
/0101 { /type "deny" /method "POST" /url "*/content/*" /query "*javascript:*" }