CVE-2026-47951: Adobe Experience Manager XSS Vulnerability

CVE-2026-47951 Overview

CVE-2026-47951 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM). The flaw exists in vulnerable form fields where input is not properly sanitized before being rendered. A low-privileged authenticated attacker can inject malicious JavaScript that executes in the browser of any victim who later views the affected page. The vulnerability carries a changed scope, meaning the impact extends beyond the vulnerable component to other resources. Affected versions include Adobe Experience Manager 6.5.24, LTS SP1, 2026.04, and earlier releases. Adobe published the fix in security advisory APSB26-56.

Critical Impact
Authenticated attackers can persist malicious JavaScript inside AEM pages, hijacking victim sessions and performing actions in the context of other users including administrators.

Affected Products

Adobe Experience Manager 6.5.24 and earlier
Adobe Experience Manager LTS SP1
Adobe Experience Manager 2026.04 (AEM Cloud Service) and earlier

Discovery Timeline

2026-06-09 - CVE-2026-47951 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47951

Vulnerability Analysis

The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation. Adobe Experience Manager fails to sanitize user-controlled input submitted through form fields before storing and rendering it in the page output. When another user navigates to the affected page, the stored payload executes in their browser session.

The attacker only needs low-level privileges to inject the payload, which makes the issue accessible to any authenticated content contributor. User interaction is required because the victim must visit the page hosting the injected payload. The changed scope reflects that the executed script runs in the security context of the AEM authoring or publishing surface, allowing the attacker to influence resources beyond the form component itself.

Root Cause

The root cause is missing output encoding and input neutralization on form field data within AEM's form rendering pipeline. Stored values are written back to the Document Object Model (DOM) without HTML or JavaScript context-aware escaping, enabling persistent script injection.

Attack Vector

Exploitation occurs over the network. An attacker with low-privileged AEM credentials submits a crafted payload containing JavaScript into a vulnerable form field. The payload is persisted in the AEM repository. When an administrator or another authenticated user opens the page rendering that field, the JavaScript executes under their session, enabling cookie theft, request forgery, or content manipulation.

No public proof-of-concept exploit code has been released. See the Adobe Security Advisory APSB26-56 for vendor-supplied technical details.

Detection Methods for CVE-2026-47951

Indicators of Compromise

Unexpected <script>, onerror, onload, or javascript: strings stored in AEM form field properties under /content nodes.
Outbound HTTP requests from authenticated AEM author sessions to unfamiliar domains shortly after viewing form pages.
Anomalous session cookie reuse from new IP addresses following administrator visits to user-generated content pages.

Detection Strategies

Audit JCR repository content for form field values containing HTML tags or JavaScript event handlers using AEM query tools.
Enable Content Security Policy (CSP) reporting and review violations originating from AEM-hosted pages.
Correlate web application firewall (WAF) logs for form submissions containing encoded script payloads against the list of low-privileged contributor accounts.

Monitoring Recommendations

Monitor AEM access logs for POST requests to form endpoints containing suspicious characters such as <, >, or javascript:.
Track creation and modification events on cq:Page and form-related nodes by low-privileged users.
Alert on administrator browser sessions that issue unexpected XMLHttpRequest or fetch calls to external hosts.

How to Mitigate CVE-2026-47951

Immediate Actions Required

Apply the security updates referenced in Adobe Security Advisory APSB26-56 to all AEM 6.5, LTS, and Cloud Service instances.
Review and restrict accounts holding form authoring privileges to trusted users only.
Audit existing form field content for previously injected payloads and remove malicious entries.

Patch Information

Adobe released fixed builds for Adobe Experience Manager 6.5.24, LTS SP1, and version 2026.04 as documented in advisory APSB26-56. Customers running AEM Cloud Service should confirm they are on the latest service release. On-premise customers must install the corresponding service pack or hotfix from the Adobe Software Distribution portal.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts on AEM-rendered pages until patches are applied.
Configure AEM Dispatcher filters to block form submissions containing HTML tag characters where business logic permits.
Temporarily revoke form editing permissions from low-privileged groups until the patched version is deployed.

bash

# Example AEM Dispatcher filter to block suspicious form submission payloads
/0100 { /type "deny" /method "POST" /url '*<script*' }
/0101 { /type "deny" /method "POST" /url '*javascript:*' }
/0102 { /type "deny" /method "POST" /url '*onerror=*' }