CVE-2026-47980: Adobe Experience Manager XSS Vulnerability

CVE-2026-47980 Overview

CVE-2026-47980 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, 2026.04, and earlier. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when the victim browses to the page containing the affected field. The vulnerability has a changed scope, meaning the injected script can impact resources beyond the vulnerable component. Adobe published a security advisory tracking this issue as APSB26-56. The flaw maps to CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated low-privilege attackers can persist malicious JavaScript in AEM pages, hijacking sessions and performing actions in the context of any user who views the affected content.

Affected Products

Adobe Experience Manager 6.5.24 and earlier
Adobe Experience Manager LTS SP1 and earlier
Adobe Experience Manager 2026.04 (AEM Cloud Service) and earlier

Discovery Timeline

2026-06-09 - CVE-2026-47980 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47980

Vulnerability Analysis

The issue is a stored Cross-Site Scripting flaw in form-handling components within Adobe Experience Manager. AEM accepts attacker-supplied input through specific form fields without sufficient output encoding or sanitization. The unsanitized input is persisted in the content repository and rendered back to other users as part of normal page output. When the browser parses the rendered response, the injected <script> payload executes inside the victim's session context.

Because the CVSS scope is changed, a successful payload can access resources outside the originally vulnerable security authority. Attackers can read DOM content, exfiltrate session tokens, and pivot to administrative interfaces that a victim author or administrator has access to. The vulnerability requires user interaction, meaning a victim must browse to the page containing the malicious field.

Root Cause

The root cause is improper neutralization of user-controlled input rendered into HTML output [CWE-79]. AEM does not apply context-appropriate encoding when rendering attacker-controlled values stored in form field properties. The stored nature of the flaw makes it persistent and reusable against any user who views the affected component.

Attack Vector

An authenticated attacker with low privileges, such as a content contributor or form author, submits a crafted payload into a vulnerable form field. The payload is stored in the JCR repository. When a higher-privileged user, such as an administrator, navigates to the page containing the field, the script executes in their browser. Adobe has not disclosed verified exploitation details. Refer to the Adobe Security Advisory APSB26-56 for vendor-specific technical references.

Detection Methods for CVE-2026-47980

Indicators of Compromise

Unexpected <script>, onerror=, or javascript: strings persisted in JCR node properties tied to form components.
Author or administrator sessions making unusual outbound HTTP requests to external domains shortly after viewing form-bearing pages.
New or modified content nodes created by low-privileged accounts containing HTML or JavaScript syntax in text fields.

Detection Strategies

Review AEM access logs for POST requests to /content/* and form submission endpoints containing encoded script payloads.
Run repository queries against cq:Page and nt:unstructured nodes searching for <script, onerror, onload, and javascript: substrings in form-related properties.
Correlate content authoring events with subsequent anomalous browser behavior from author or admin accounts.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting and monitor report-uri endpoints for violations originating from AEM author and publish instances.
Audit Dispatcher logs for cached responses containing inline script tags injected via form fields.
Track logins and content modifications from low-privileged accounts that immediately precede sessions from privileged users on the same content paths.

How to Mitigate CVE-2026-47980

Immediate Actions Required

Apply the fixes referenced in Adobe Security Advisory APSB26-56 to all AEM 6.5, LTS, and Cloud Service instances.
Audit existing content for stored script payloads in form components before patching to prevent re-execution post-update.
Restrict form authoring permissions to trusted users and review group memberships granting write access to form components.

Patch Information

Adobe has released updates addressing CVE-2026-47980 for Adobe Experience Manager 6.5, LTS, and Cloud Service. Administrators should apply the latest service pack or hotfix referenced in the APSB26-56 advisory. AEM as a Cloud Service customers receive updates through Adobe's managed update channel and should validate that their instance has been rolled forward to a version later than 2026.04.

Workarounds

Deploy a strict Content Security Policy on AEM author and publish endpoints to block inline script execution.
Configure AEM Dispatcher rules to filter HTML tags and event-handler attributes from form-submitted parameters.
Temporarily revoke modify permissions on form components for non-essential authoring accounts until patching is complete.

bash

# Example AEM Dispatcher filter to block script payloads in form parameters
/0100 { /type "deny" /url '*<script*' }
/0101 { /type "deny" /url '*onerror=*' }
/0102 { /type "deny" /url '*javascript:*' }