CVE-2026-47970: Adobe Experience Manager XSS Vulnerability

CVE-2026-47970 Overview

CVE-2026-47970 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, 2026.04 and earlier. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The injected script executes in the browser of any victim who visits the page containing the affected field. The vulnerability carries a changed scope, meaning the impact extends beyond the originally vulnerable component. The flaw maps to CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers with low privileges can execute arbitrary JavaScript in victim browsers, enabling session theft, credential harvesting, and content manipulation within the AEM authoring environment.

Affected Products

Adobe Experience Manager 6.5.24 and earlier
Adobe Experience Manager LTS SP1 and earlier
Adobe Experience Manager 2026.04 and earlier (including AEM Cloud Service)

Discovery Timeline

2026-06-09 - CVE-2026-47970 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47970

Vulnerability Analysis

The vulnerability resides in AEM form field input handling. The application stores attacker-supplied content without adequately neutralizing HTML and JavaScript control characters. When a victim renders the page containing the stored payload, the browser parses and executes the injected script in the context of the AEM origin.

Because the CVSS scope is changed, the executed JavaScript can affect resources outside the originally vulnerable component's security authority. User interaction is required, as a victim must browse to the page that renders the malicious form field. The attacker must hold a low-privileged authenticated account to plant the payload.

Exploitation impacts confidentiality and integrity at a low level. Typical outcomes include theft of session cookies, exfiltration of CSRF tokens, forced administrative actions through the victim's session, and modification of rendered page content.

Root Cause

The root cause is improper neutralization of user-supplied input written into form field values. Output encoding for the HTML and JavaScript contexts is either missing or incomplete on the affected rendering path, allowing <script> tags and event handlers to persist through storage and reach the browser.

Attack Vector

The attack is delivered over the network against the AEM authoring or publishing interface. The attacker authenticates with a low-privileged account, submits a form payload containing JavaScript, and waits for a higher-privileged user to view the affected page. No verified public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is publicly available. See the Adobe Security Advisory APSB26-56 for vendor technical details.

Detection Methods for CVE-2026-47970

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or on* event handler attributes stored in AEM form field properties within the JCR repository.
AEM request.log or access log entries showing POST requests to form submission endpoints containing encoded HTML or script payloads from low-privileged authoring accounts.
Outbound browser connections from authoring users to attacker-controlled domains shortly after viewing affected pages.

Detection Strategies

Audit JCR content nodes under /content and /conf for property values containing script tags, event handlers, or encoded JavaScript payloads.
Deploy Content Security Policy (CSP) headers in report-only mode to surface inline script execution attempts on AEM-rendered pages.
Review AEM audit logs for content modifications by low-privileged users targeting form components.

Monitoring Recommendations

Forward AEM dispatcher, request, and audit logs to a centralized SIEM and alert on suspicious payload patterns in form submissions.
Monitor for anomalous authoring activity such as edits by accounts that rarely touch form components.
Track browser-reported CSP violations to identify in-progress exploitation attempts.

How to Mitigate CVE-2026-47970

Immediate Actions Required

Apply the security updates referenced in Adobe Security Advisory APSB26-56 to all affected on-premise, LTS, and Cloud Service deployments.
Review and revoke unnecessary low-privileged authoring accounts that could plant stored payloads.
Audit existing form field content for previously injected scripts and remove malicious entries.

Patch Information

Adobe has released fixed builds for AEM 6.5, AEM LTS, and AEM as a Cloud Service. Customers should consult the Adobe Security Advisory APSB26-56 for exact fixed version identifiers and upgrade guidance. AEM Cloud Service customers receive updates through Adobe's managed release channel.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Restrict authoring permissions so only vetted users can create or edit form components on production content.
Configure the AEM dispatcher to filter or reject request parameters containing HTML or script characters on form endpoints.

bash

# Example Content-Security-Policy header to mitigate stored XSS execution
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'