CVE-2026-47977: Adobe Experience Manager XSS Vulnerability

CVE-2026-47977 Overview

CVE-2026-47977 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, 2026.04, and earlier releases. The flaw resides in form field handling, where input is rendered without adequate output encoding. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they load the page containing the tainted field. The vulnerability carries a changed scope, meaning the impact can extend beyond the originally compromised security context.

Critical Impact
Authenticated attackers can persist JavaScript payloads in AEM form fields, leading to session hijacking, content defacement, and unauthorized actions executed under a victim's authority across a different security scope.

Affected Products

Adobe Experience Manager 6.5.24 and earlier
Adobe Experience Manager LTS SP1 and earlier
Adobe Experience Manager 2026.04 (AEM Cloud Service) and earlier

Discovery Timeline

2026-06-09 - CVE-2026-47977 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47977

Vulnerability Analysis

The issue is classified as Improper Neutralization of Input During Web Page Generation [CWE-79]. AEM authors and content contributors can populate form fields through the authoring interface. The application stores attacker-controlled markup and later renders it back to viewers without sufficient escaping. When a victim navigates to the affected page, the browser parses the injected <script> content as executable code. Because the CVSS vector indicates a changed scope, the executed script can affect resources beyond the vulnerable component, such as parent frames, administrative consoles, or federated sites that trust the AEM origin. User interaction is required, since a victim must browse to the page hosting the payload.

Root Cause

The root cause is missing or incomplete output encoding when AEM serializes user-supplied form field values into the rendered HTML response. Adobe's form components do not apply context-aware escaping (HTML entity, attribute, or JavaScript encoding) before reflecting persisted values to subsequent page visitors.

Attack Vector

An attacker authenticates with low privileges sufficient to author or edit forms within AEM. The attacker submits a JavaScript payload through the vulnerable field. AEM persists the payload in the repository. When any user with access to that page loads it, the script executes in their session context, allowing token theft, forced administrative actions, or redirection to attacker-controlled infrastructure.

No verified public proof-of-concept exists for this vulnerability. Refer to the Adobe Security Advisory APSB26-56 for vendor-supplied technical details.

Detection Methods for CVE-2026-47977

Indicators of Compromise

Form field values in AEM content repositories containing <script>, javascript:, onerror=, or onload= substrings.
Outbound browser requests to unfamiliar domains originating from authenticated AEM author or publish sessions.
Unexpected modifications to form components by low-privileged author accounts in the AEM audit log.

Detection Strategies

Inspect JCR repository content for stored HTML or JavaScript in form-related node properties such as jcr:title, defaultValue, and placeholder.
Deploy web application firewall rules to flag responses from AEM publish instances that contain script tags inside form field markup.
Correlate AEM authoring events with subsequent client-side script execution telemetry from monitored endpoints.

Monitoring Recommendations

Enable verbose access logging on AEM author and publish dispatchers and forward logs to a centralized analytics platform.
Monitor Content Security Policy (CSP) violation reports for blocked inline script execution on AEM-hosted pages.
Alert on changes to form templates and components made by accounts outside the standard content author group.

How to Mitigate CVE-2026-47977

Immediate Actions Required

Apply the Adobe security update referenced in APSB26-56 to all AEM on-premises and LTS deployments.
Audit existing form components for stored payloads and remove any unauthorized script content discovered in the repository.
Restrict author privileges so that only vetted users can create or modify form fields on production sites.

Patch Information

Adobe addresses CVE-2026-47977 in updates released for Adobe Experience Manager 6.5.x, LTS, and the 2026.04 Cloud Service release. Customers running AEM as a Cloud Service receive the fix through Adobe's managed update pipeline. On-premises operators must download and apply the cumulative fix pack documented in advisory APSB26-56.

Workarounds

Enforce a strict Content Security Policy that blocks inline script execution and unsanctioned external script sources on AEM publish domains.
Configure the AEM dispatcher to filter responses containing script content within form field contexts until patching is completed.
Reduce the number of accounts holding form authoring permissions to limit the attack surface for low-privileged injection.

bash

# Example dispatcher filter to deny suspicious form field payloads
/0100 { /type "deny" /url "*<script*" }
/0101 { /type "deny" /url "*javascript:*" }