CVE-2026-47962: Adobe Experience Manager XSS Vulnerability

CVE-2026-47962 Overview

CVE-2026-47962 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM). The flaw resides in vulnerable form fields that fail to sanitize attacker-controlled input. A low-privileged authenticated attacker can inject malicious JavaScript that executes in the browsers of users who visit pages containing the affected fields. The vulnerability has a changed scope, meaning impact extends beyond the vulnerable component. Adobe published the issue in security bulletin APSB26-56. Affected releases include Adobe Experience Manager 6.5.24, AEM LTS SP1, AEM Cloud Service version 2026.04, and earlier builds. The vulnerability is tracked under CWE-79.

Critical Impact
Authenticated attackers with low privileges can store JavaScript payloads in AEM form fields, executing arbitrary script in victim browsers and enabling session theft, content defacement, or pivoting to higher-privileged accounts.

Affected Products

Adobe Experience Manager 6.5.24 and earlier
Adobe Experience Manager LTS SP1 and earlier
Adobe Experience Manager Cloud Service version 2026.04 and earlier

Discovery Timeline

2026-06-09 - CVE-2026-47962 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47962

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw in Adobe Experience Manager form components. AEM accepts user-supplied input into form fields without enforcing sufficient output encoding or input sanitization. The malicious payload persists in backend storage and is rendered to other users when they load the affected page. Because the scope is changed, code injected into one AEM component can affect resources or sessions outside the originally compromised security context. This raises the practical impact above a standard reflected XSS, since persistent payloads execute every time the affected content is rendered.

Root Cause

The root cause is insufficient neutralization of input during web page generation, classified under CWE-79. AEM stores form field contents and later embeds them into HTML output without contextual escaping. Script content placed inside the form field passes through the persistence layer intact and is interpreted by the browser as executable JavaScript when rendered.

Attack Vector

Exploitation requires network access to the AEM author or publish instance and an authenticated session with low privileges, such as a content contributor able to edit forms. User interaction is required: a victim must browse to the page that renders the malicious field. Successful exploitation results in JavaScript execution in the victim's browser session, which can lead to session cookie theft, forced actions through CSRF chaining, or AEM administrator account compromise if a privileged user visits the page.

No public proof-of-concept exploit code is available at this time. Refer to the Adobe Security Advisory APSB26-56 for vendor technical details.

Detection Methods for CVE-2026-47962

Indicators of Compromise

Form field values in AEM repositories containing <script>, javascript:, onerror=, onload=, or other HTML event handler attributes.
Unexpected outbound HTTP requests from AEM author or publish instances to attacker-controlled domains shortly after form submissions.
Browser console errors or Content Security Policy violations reported by users when viewing AEM-rendered pages.

Detection Strategies

Audit JCR repository nodes under /content and form storage paths for stored values containing HTML or JavaScript syntax.
Review AEM request.log and access.log entries for POST requests to form submission endpoints from low-privileged accounts containing suspicious payloads.
Enable Content Security Policy headers on AEM-served pages and monitor CSP violation reports for inline script execution attempts.

Monitoring Recommendations

Forward AEM web server and dispatcher logs to a centralized SIEM and alert on form submissions containing script tags or JavaScript URI schemes.
Monitor administrator and author account activity for anomalous session behavior following form-rendering page visits.
Track changes to form components and Sling resources through AEM audit logging to identify unauthorized content modifications.

How to Mitigate CVE-2026-47962

Immediate Actions Required

Apply Adobe's security update from bulletin APSB26-56 to all AEM instances, including author, publish, and dispatcher tiers.
Audit low-privileged AEM accounts and revoke unnecessary content editing permissions until patches are deployed.
Inspect form components across the repository for stored script payloads and remove any malicious entries.

Patch Information

Adobe has released fixed versions addressing the stored XSS issue. Customers should upgrade to the patched releases referenced in the Adobe Security Advisory APSB26-56. AEM Cloud Service customers receive updates through the standard release channel; on-premises AEM 6.5 and LTS deployments require manual installation of the service pack.

Workarounds

Configure the AEM dispatcher to filter request payloads containing HTML tags or JavaScript syntax in form parameters.
Apply strict Content Security Policy headers that disallow inline scripts and restrict script sources to trusted origins.
Restrict form editing capabilities to trusted authors and require peer review of form component changes prior to publication.

bash

# Example AEM dispatcher filter rule to block script payloads in query strings
/0100 { /type "deny" /url '*<script*' }
/0101 { /type "deny" /url '*javascript:*' }