CVE-2026-47972: Adobe Experience Manager XSS Vulnerability

CVE-2026-47972 Overview

CVE-2026-47972 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM). Affected releases include AEM 6.5.24, AEM LTS SP1, AEM 2026.04, and earlier versions. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they load the page rendering the affected field. Adobe notes the scope is changed, meaning the impact extends beyond the vulnerable component. The issue is tracked under [CWE-79] and addressed in Adobe Security Bulletin APSB26-56.

Critical Impact
Authenticated attackers can persist JavaScript payloads in AEM form fields, hijacking sessions or performing actions on behalf of any user who views the affected page.

Affected Products

Adobe Experience Manager 6.5.24 and earlier
Adobe Experience Manager LTS SP1 and earlier
Adobe Experience Manager 2026.04 and earlier (including AEM Cloud Service)

Discovery Timeline

2026-06-09 - CVE-2026-47972 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47972

Vulnerability Analysis

The flaw is a stored XSS issue in Adobe Experience Manager form fields. AEM accepts user-supplied content for certain form inputs without enforcing sufficient output encoding or sanitization. An authenticated attacker with low privileges submits crafted input containing JavaScript. AEM stores the payload and later renders it inside the HTML response served to other users.

When a victim navigates to the page containing the vulnerable field, the browser parses the attacker-controlled markup and executes the script in the context of the AEM origin. Because the scope is changed, the executed script can affect resources beyond the vulnerable component, including authenticated sessions of higher-privileged users such as authors or administrators.

The vulnerability requires user interaction to trigger and authenticated access to inject the payload, which limits unauthenticated mass exploitation but remains relevant for multi-tenant authoring environments.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. AEM does not consistently encode or filter script-bearing content submitted through specific form fields before rendering it back to clients.

Attack Vector

Exploitation occurs over the network against an AEM instance. The attacker authenticates with a low-privilege account, posts a JavaScript payload into a vulnerable form field, and waits for another user to load the page that renders the stored content. The payload then executes with the victim's privileges, enabling session token theft, forced actions, or content tampering across the AEM author or publish environment.

No public proof-of-concept or exploit code is available for CVE-2026-47972 at the time of publication. See the Adobe Security Advisory APSB26-56 for vendor technical details.

Detection Methods for CVE-2026-47972

Indicators of Compromise

Form field values in AEM repositories containing <script>, javascript:, or event-handler attributes such as onerror= and onload=
Outbound requests from AEM author or publish nodes to unfamiliar domains immediately after a page render
Unexpected session activity from privileged AEM accounts shortly after viewing user-submitted content

Detection Strategies

Review AEM access logs for POST requests to form-submission endpoints containing HTML or script syntax in field parameters
Query the JCR repository for stored node properties containing script tags or JavaScript URI schemes
Monitor browser-side Content Security Policy (CSP) violation reports originating from AEM-served pages

Monitoring Recommendations

Enable verbose request logging on AEM author instances and forward to a centralized SIEM for correlation
Alert on creation or modification of form-related JCR nodes by low-privileged accounts
Track anomalous authentication events for AEM administrator and author roles following content viewing

How to Mitigate CVE-2026-47972

Immediate Actions Required

Apply the security updates referenced in Adobe Security Advisory APSB26-56 to all affected AEM instances
Audit existing form submissions and stored content for previously injected script payloads
Restrict form-authoring permissions to trusted accounts and review recent permission grants

Patch Information

Adobe addressed CVE-2026-47972 in updates listed under bulletin APSB26-56. Upgrade Adobe Experience Manager to a fixed release beyond 6.5.24, LTS SP1, or 2026.04. AEM Cloud Service customers receive the fix through the standard Cloud Manager update channel. Confirm the deployed version after patching and re-run security regression tests on customized form components.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts on AEM-served pages
Place a web application firewall in front of AEM and block requests containing script tags or JavaScript URI schemes in form parameters
Temporarily disable or restrict access to vulnerable form components until the patch is deployed

bash

# Example CSP response header for AEM dispatcher configuration
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"