CVE-2026-47973: Adobe Experience Manager XSS Vulnerability

CVE-2026-47973 Overview

CVE-2026-47973 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM). The flaw exists in Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The injected payload executes in a victim's browser when they visit the affected page. The vulnerability carries a changed scope, meaning impact extends beyond the vulnerable component into other security authorities.

Critical Impact

Authenticated attackers with low privileges can inject persistent JavaScript that executes in any user's browser session, enabling session theft, content manipulation, and privilege escalation through scope change.

Affected Products

• Adobe Experience Manager 6.5.24 and earlier
• Adobe Experience Manager LTS SP1 and earlier
• Adobe Experience Manager 2026.04 and earlier (including AEM Cloud Service)

Discovery Timeline

• 2026-06-09 - CVE-2026-47973 published to the National Vulnerability Database
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47973

Vulnerability Analysis

The vulnerability is classified as Cross-Site Scripting [CWE-79]. Adobe Experience Manager fails to sanitize user-supplied input written to form fields. Malicious script content persists in the application's data store. When a victim renders a page containing the tainted field, the browser parses and executes the attacker's JavaScript in the application origin.

The changed scope indicates that successful exploitation impacts resources beyond the vulnerable component. An attacker abusing a content-author session can pivot to higher-privileged users whose browsers render the malicious content. User interaction is required because the victim must browse to the affected page.

Root Cause

The root cause is improper neutralization of input during web page generation. Adobe Experience Manager stores attacker-controlled markup without applying context-appropriate output encoding. When the form field is rendered in HTML, embedded <script> tags or event handlers execute in the victim's session.

Attack Vector

Exploitation requires network access and low-privileged authenticated credentials, such as a content contributor account. The attacker submits a crafted payload to a vulnerable form field within AEM. Any user who later loads the page containing the tainted field triggers script execution. The payload can read cookies accessible to JavaScript, perform actions on behalf of the victim, or exfiltrate AEM authoring data to an external endpoint.

No verified public proof-of-concept code is available for CVE-2026-47973. See the Adobe Security Advisory APSB26-56 for vendor-published details.

Detection Methods for CVE-2026-47973

Indicators of Compromise

• Unexpected <script>, onerror, onload, or javascript: strings stored in AEM form field content within the Java Content Repository (JCR).
• Outbound HTTP requests from author or publish instances to unfamiliar domains referenced in stored content.
• AEM audit log entries showing form field modifications by low-privileged accounts followed by access from higher-privileged users.

Detection Strategies

• Review JCR nodes for stored values containing HTML control characters, encoded script tags, or DOM event handlers in fields that should hold plain text.
• Inspect AEM access logs for repeated POST requests to form submission endpoints from a single low-privileged account.
• Deploy Content Security Policy (CSP) reporting to surface inline script violations originating from AEM-rendered pages.

Monitoring Recommendations

• Monitor browser-side CSP violation reports for the AEM author and publish hostnames.
• Alert on AEM audit events where users with content-contributor roles modify shared or template-level form components.
• Track anomalous session activity such as administrator account actions occurring immediately after viewing user-generated content pages.

How to Mitigate CVE-2026-47973

Immediate Actions Required

• Apply the Adobe security update referenced in APSB26-56 to all AEM author, publish, and Cloud Service instances.
• Audit low-privileged AEM accounts and revoke unnecessary content-authoring permissions.
• Review recently modified form components and templates for embedded script content.

Patch Information

Adobe released fixed builds addressing CVE-2026-47973 in the APSB26-56 advisory. Upgrade Adobe Experience Manager 6.5.x past version 6.5.24, apply the LTS SP1 update, and update Cloud Service deployments past the 2026.04 release. Verify version strings in /system/console/status-productinfo after patching.

Workarounds

• Restrict form authoring permissions to trusted users until the patch is applied.
• Enforce a strict Content Security Policy that disallows inline scripts and untrusted origins on AEM-delivered pages.
• Enable AEM's built-in XSS protection APIs and verify that custom components use XSSAPI.encodeForHTML() and related encoders.

# Configuration example: enforce CSP header at the Dispatcher
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report"