CVE-2026-47966: Adobe Experience Manager XSS Vulnerability

CVE-2026-47966 Overview

CVE-2026-47966 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, 2026.04, and earlier. The flaw allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields. When a victim browses to a page containing the tainted field, the script executes in their browser session. The vulnerability has a changed scope, meaning the injected payload affects components beyond the originally vulnerable one. Adobe documented the issue in security bulletin APSB26-56.

Critical Impact
Authenticated attackers can persist malicious JavaScript in AEM form fields, leading to session theft, credential harvesting, and unauthorized actions in the context of any user who views the affected page.

Affected Products

Adobe Experience Manager 6.5.24 and earlier
Adobe Experience Manager LTS SP1 and earlier
Adobe Experience Manager 2026.04 and earlier (including AEM Cloud Service)

Discovery Timeline

2026-06-09 - CVE-2026-47966 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47966

Vulnerability Analysis

The vulnerability is classified as Improper Neutralization of Input During Web Page Generation [CWE-79], commonly known as stored XSS. AEM fails to sanitize user-supplied input submitted through specific form fields before persisting the data. When the data is later rendered in another user's browser, the embedded JavaScript executes within the AEM application origin.

Exploitation requires the attacker to hold a low-privileged AEM account capable of submitting form content. User interaction is required because the payload triggers only when a victim navigates to the affected page. Because the vulnerability has a changed scope, the injected code can affect resources outside the originally compromised component, including administrative interfaces consumed by higher-privileged users.

Root Cause

The root cause is missing or insufficient output encoding when AEM renders content submitted through affected form fields. Stored payloads are written back into the HTML response without contextual escaping, allowing <script> tags and event handler attributes to execute in the victim's browser.

Attack Vector

An authenticated attacker submits a crafted payload through an AEM form field that lacks server-side sanitization. The payload is stored in the AEM repository. When an administrator, author, or end user later views the page containing the field, the browser parses and executes the attacker-controlled JavaScript. Typical post-exploitation activity includes stealing session cookies, performing actions as the victim, redirecting users to phishing sites, or pivoting to higher-privileged accounts that view the rendered content.

No verified proof-of-concept code has been published. Refer to the Adobe Security Bulletin APSB26-56 for vendor-confirmed technical details.

Detection Methods for CVE-2026-47966

Indicators of Compromise

AEM repository entries containing <script> tags, javascript: URIs, or DOM event handlers such as onerror= and onload= within form field values
Outbound HTTP requests from authenticated AEM user sessions to attacker-controlled domains shortly after page loads
Unexpected session cookie usage from geographically inconsistent IP addresses following form page visits

Detection Strategies

Review AEM access logs for POST requests to form endpoints containing encoded or raw script payloads in parameter values
Inspect content stored in the JCR repository for HTML and JavaScript tokens in fields that should accept only plain text
Correlate authenticated form submissions from low-privileged accounts with subsequent privileged user activity on the same pages

Monitoring Recommendations

Enable AEM Dispatcher logging and forward request bodies and response anomalies to a centralized SIEM
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution attempts
Alert on AEM user accounts that submit form content containing HTML control characters or encoded script fragments

How to Mitigate CVE-2026-47966

Immediate Actions Required

Apply the patches referenced in Adobe Security Bulletin APSB26-56 to all on-premises and LTS AEM instances
Audit existing form field content in the JCR repository and remove any stored HTML or JavaScript payloads
Review low-privileged AEM accounts and revoke access for unused or stale identities

Patch Information

Adobe has released fixed builds for AEM 6.5, AEM LTS, and AEM as a Cloud Service. Customers on AEM as a Cloud Service receive the fix automatically; on-premises and LTS customers must install the corresponding service pack or hotfix listed in APSB26-56.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources
Configure AEM Dispatcher and any upstream web application firewall to filter HTML control characters in form submissions to known-vulnerable endpoints
Restrict form submission permissions to vetted user groups until patches are deployed

bash

# Example AEM Dispatcher filter rule to block script payloads in form submissions
/0100 { /type "deny" /method "POST" /url "*/content/forms/*" /query ".*(<script|javascript:|onerror=|onload=).*" }