CVE-2026-47975: Adobe Experience Manager XSS Vulnerability

CVE-2026-47975 Overview

CVE-2026-47975 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, 2026.04, and earlier. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they visit the page containing the affected field. The flaw carries a changed scope, meaning the impact extends beyond the vulnerable component to other security boundaries. Adobe published advisory APSB26-56 to address the issue. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
An authenticated attacker with low privileges can store JavaScript payloads in AEM form fields and execute them in the browser context of any user who views the affected page.

Affected Products

Adobe Experience Manager 6.5.24 and earlier
Adobe Experience Manager LTS SP1 and earlier
Adobe Experience Manager 2026.04 and earlier (including AEM Cloud Service)

Discovery Timeline

2026-06-09 - CVE-2026-47975 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47975

Vulnerability Analysis

The vulnerability resides in form field handling within Adobe Experience Manager. AEM fails to properly neutralize user-supplied input before storing it and rendering it back in HTML output. An authenticated attacker who can submit data to vulnerable form fields can persist JavaScript that later executes in the browsers of users who navigate to the affected page.

The CVSS vector indicates a scope change, which means the injected script can affect resources beyond the AEM component that processed the input. In practical terms, an attacker can target administrators, content editors, or site visitors with session theft, credential harvesting through fake login overlays, or unauthorized actions performed in the victim's authenticated context. User interaction is required, since the victim must browse to the page hosting the malicious payload.

With an EPSS score of 0.03%, public exploitation activity is currently unlikely. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper output encoding and input sanitization in form field rendering paths. Stored XSS occurs when an application accepts attacker-controlled input, persists it in a data store, and later returns it in an HTTP response without context-appropriate encoding. AEM's vulnerable form components do not enforce strict HTML or JavaScript context encoding, allowing <script> tags or event handler attributes to survive the storage and rendering pipeline.

Attack Vector

The attack vector is network-based and requires a low-privileged authenticated account on the AEM instance. The attacker submits a crafted payload to a vulnerable form field, for example through an authoring interface or a public-facing form that accepts authenticated submissions. The payload persists in the AEM repository. When a victim user navigates to the page rendering the stored content, the browser executes the injected script under the AEM origin. Because scope is changed, the script can interact with cookies, tokens, or APIs beyond the vulnerable component's normal authority.

No public proof-of-concept exploit has been published. Adobe has not reported active exploitation in the wild. See the Adobe Security Bulletin APSB26-56 for vendor-supplied technical details.

Detection Methods for CVE-2026-47975

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or DOM event handler attributes (onerror, onload, onclick) stored in AEM form field content within the JCR repository.
Anomalous outbound HTTP requests from authoring or publish nodes to attacker-controlled domains, indicating data exfiltration from executed payloads.
Authentication tokens or session cookies appearing in third-party referrer logs originating from AEM-hosted pages.

Detection Strategies

Audit AEM content repositories for stored HTML payloads in form-related node properties using tools such as the JCR query console or Content Repository Explorer.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution attempts on AEM-delivered pages.
Review web server access logs for POST requests from low-privileged accounts targeting form submission endpoints, then correlate with subsequent GET activity to the same content paths.

Monitoring Recommendations

Enable AEM audit logging for content modifications and forward events to a centralized SIEM for correlation.
Monitor authentication logs for unusual activity on low-privileged accounts with content authoring rights.
Alert on browser-side errors or CSP violation reports referencing AEM-hosted form pages.

How to Mitigate CVE-2026-47975

Immediate Actions Required

Apply the Adobe security updates referenced in APSB26-56 to all affected AEM 6.5.x, LTS, and 2026.x instances.
Review existing form field content for previously injected scripts and sanitize or remove malicious payloads before patching.
Restrict authoring privileges to trusted users and audit accounts with form submission rights.

Patch Information

Adobe released fixed versions documented in security bulletin APSB26-56. Administrators should upgrade to the patched releases of AEM 6.5, AEM LTS, and AEM 2026.04 as identified by Adobe. AEM as a Cloud Service customers should ensure they are running the latest release. Refer to the Adobe Security Bulletin APSB26-56 for exact build numbers.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Place a web application firewall in front of AEM with rules that block common XSS payload patterns in form submissions.
Temporarily revoke form authoring permissions from low-privileged accounts until patches are applied.

bash

# Example Content-Security-Policy response header for AEM dispatcher
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"