CVE-2026-47985: Adobe Experience Manager XSS Vulnerability

CVE-2026-47985 Overview

CVE-2026-47985 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM). The flaw exists in AEM versions 6.5.24, LTS SP1, 2026.04, and earlier releases. An attacker can manipulate the Document Object Model (DOM) to execute arbitrary JavaScript within the victim's browser context. Successful exploitation requires user interaction, where the victim must visit a crafted webpage. The vulnerability has a changed scope, meaning impact extends beyond the vulnerable component. Adobe published security advisory APSB26-56 to address the issue.

Critical Impact
Attackers can execute malicious JavaScript in a victim's browser session, enabling session hijacking, credential theft, and unauthorized actions against AEM-hosted content.

Affected Products

Adobe Experience Manager 6.5.24 and earlier
Adobe Experience Manager LTS SP1 and earlier
Adobe Experience Manager 2026.04 and earlier (including AEM Cloud Service)

Discovery Timeline

2026-06-09 - CVE-2026-47985 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47985

Vulnerability Analysis

The vulnerability is classified under [CWE-79], Improper Neutralization of Input During Web Page Generation. Unlike reflected or stored XSS, DOM-based XSS occurs entirely in the client-side JavaScript runtime. The vulnerable AEM code paths read attacker-controlled data from sources such as location.hash, document.URL, or document.referrer and pass that data into a dangerous sink without sanitization. Sinks include innerHTML, document.write, or eval. The scope change indicates the executed script can affect resources beyond the vulnerable component, including authenticated AEM author or publish sessions.

Root Cause

The root cause is insufficient neutralization of untrusted input within client-side JavaScript executed by AEM components. AEM dispatches user-controlled values from URL parameters or fragment identifiers into DOM APIs that interpret strings as HTML or executable code. Without contextual output encoding, attacker-supplied payloads are parsed and executed by the browser.

Attack Vector

Exploitation requires the attacker to craft a malicious URL or webpage targeting an AEM instance and convince an authenticated user to visit it. Low-privilege authentication is required on the AEM instance for the payload to reach the vulnerable component. Once the victim loads the crafted page, the injected JavaScript executes in the browser under the AEM origin. Attackers can steal session tokens, perform actions as the victim, or pivot to other in-scope resources due to the changed scope.

No public proof-of-concept code is available. See the Adobe Security Advisory APSB26-56 for vendor-confirmed technical details.

Detection Methods for CVE-2026-47985

Indicators of Compromise

Unexpected JavaScript execution within AEM author or publish sessions, especially involving outbound requests to attacker-controlled domains
HTTP requests to AEM endpoints containing encoded JavaScript payloads in query strings, fragments, or referrer headers
Anomalous session activity, such as content modifications or privilege changes performed shortly after a user clicked an external link

Detection Strategies

Inspect web server and reverse proxy logs for AEM requests containing suspicious URL fragments, javascript: schemes, or HTML entity sequences
Deploy a Content Security Policy (CSP) in report-only mode to identify inline script execution and unauthorized script sources targeting AEM
Correlate browser endpoint telemetry with AEM access logs to detect script execution that follows user navigation from external referrers

Monitoring Recommendations

Monitor AEM dispatcher and CDN logs for repeated requests carrying DOM-XSS payload patterns such as <script>, onerror=, or javascript: strings
Alert on AEM authenticated sessions performing unusual API calls immediately after page loads originating from external referrers
Track outbound network connections from AEM author workstations to newly observed or low-reputation domains

How to Mitigate CVE-2026-47985

Immediate Actions Required

Apply the security updates referenced in Adobe advisory APSB26-56 to all AEM 6.5, LTS, and 2026.x instances
Restrict access to AEM author instances to trusted networks and require VPN or zero-trust access for content authors
Enforce a strict Content Security Policy on AEM author and publish tiers to limit inline script execution

Patch Information

Adobe released fixed versions addressing CVE-2026-47985 through security bulletin APSB26-56. Administrators should upgrade beyond AEM 6.5.24, LTS SP1, and 2026.04. AEM Cloud Service customers receive the fix through the standard release pipeline. Refer to the Adobe Security Advisory APSB26-56 for exact patched build numbers and upgrade instructions.

Workarounds

Configure the AEM dispatcher to filter and reject requests containing common XSS payload patterns until patches are applied
Disable or restrict access to the affected AEM components for unauthenticated and low-privileged users
Implement browser-side defenses such as X-XSS-Protection, X-Content-Type-Options: nosniff, and a restrictive CSP header

bash

# Example AEM dispatcher filter rule to block obvious XSS payloads
/0100 { /type "deny" /url '*<script*' }
/0101 { /type "deny" /url '*javascript:*' }
/0102 { /type "deny" /url '*onerror=*' }