CVE-2026-47958: Adobe Experience Manager XSS Vulnerability

CVE-2026-47958 Overview

CVE-2026-47958 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM). The flaw exists in vulnerable form fields that fail to properly sanitize user-supplied input. A low-privileged authenticated attacker can inject malicious JavaScript that executes in a victim's browser when they navigate to the page containing the compromised field. The vulnerability has a changed scope, meaning the injected payload can impact resources beyond the vulnerable component's security boundary. The issue is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Stored XSS allows attackers to execute arbitrary JavaScript in victim browsers, enabling session theft, credential harvesting, and unauthorized actions across the AEM application boundary.

Affected Products

Adobe Experience Manager 6.5.24 and earlier
Adobe Experience Manager LTS SP1 and earlier
Adobe Experience Manager 2026.04 and earlier (including AEM Cloud Service)

Discovery Timeline

2026-06-09 - CVE-2026-47958 published to the National Vulnerability Database
2026-06-10 - CVE record last updated in NVD

Technical Details for CVE-2026-47958

Vulnerability Analysis

The vulnerability resides in form-field handling within Adobe Experience Manager. AEM accepts user-supplied content destined for form fields but fails to apply adequate output encoding when that content is rendered back to viewers. As a result, attacker-controlled JavaScript is stored on the server and served to subsequent visitors.

Exploitation requires the attacker to hold low-privileged authenticated access and depends on a victim browsing the affected page. The changed scope indicates the injected script can affect components beyond the vulnerable form's trust boundary, including authoring interfaces or administrative pages rendered in the same browser session. The EPSS probability is 0.03%, reflecting limited observed exploitation activity at publication.

Root Cause

The root cause is improper neutralization of HTML and JavaScript metacharacters in form field input before storage and rendering. AEM does not enforce contextual output encoding for the affected fields, allowing <script> tags, event handlers such as onerror and onload, and JavaScript URIs to survive into rendered HTML.

Attack Vector

The attack proceeds over the network. An authenticated low-privileged user submits a crafted payload into a vulnerable form field. The payload is persisted in AEM's content repository. When any user — including higher-privileged administrators — loads the page containing that field, the browser parses the injected script and executes it under the AEM application origin. User interaction is required, but visiting a page is a routine activity that does not raise suspicion.

No public proof-of-concept exploit has been released. Refer to the Adobe Security Advisory APSB26-56 for vendor technical details.

Detection Methods for CVE-2026-47958

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or HTML event handlers (onerror, onload, onclick) stored within AEM form field content nodes.
Outbound HTTP requests from authenticated user browsers to unfamiliar domains immediately after rendering AEM pages.
Unusual session token activity or administrative actions performed shortly after a privileged user visited a content-authoring page.

Detection Strategies

Audit AEM JCR repository content for stored field values containing HTML or JavaScript syntax that should not appear in normal form data.
Review web server and AEM dispatcher logs for POST requests from low-privileged accounts to form-handling endpoints with payloads containing encoded script fragments.
Deploy Content Security Policy (CSP) reporting to capture script-source violations that indicate injected JavaScript execution.

Monitoring Recommendations

Forward AEM access logs and authentication events to a centralized analytics platform for correlation of low-privileged content submissions with subsequent admin sessions.
Monitor browser-side telemetry from authoring users for anomalous script execution, DOM modifications, or cross-origin requests originating from AEM pages.
Track changes to form schema definitions and content nodes to identify unauthorized modifications introducing script payloads.

How to Mitigate CVE-2026-47958

Immediate Actions Required

Apply the Adobe security update referenced in APSB26-56 to all affected AEM 6.5, LTS, and 2026.x deployments.
Audit existing form-field content for stored payloads and remove any entries containing script tags, event handlers, or JavaScript URIs.
Review and reduce the number of accounts holding form-authoring privileges to limit the attacker population.

Patch Information

Adobe released fixed builds addressing CVE-2026-47958 in security bulletin APSB26-56. Customers running AEM 6.5.24, LTS SP1, and 2026.04 or earlier should upgrade to the patched versions published by Adobe. AEM Cloud Service customers receive the fix through the managed update channel. Verify deployment by checking the AEM version in the system console after the upgrade.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins until patching is complete.
Place a web application firewall in front of AEM to inspect and block form submissions containing HTML or JavaScript syntax.
Restrict access to content-authoring endpoints by IP allowlisting or VPN until the patch is applied.

bash

# Example Content-Security-Policy header to mitigate stored XSS execution
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report