CVE-2026-47944: Adobe Experience Manager Stored XSS Vulnerability – CVSS 5.4

Technical summary

CVE-2026-47944 is a stored XSS vulnerability (CWE-79) in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04, and earlier. The vulnerability exists in form field handling where insufficient input sanitization allows authenticated but low-privileged attackers to embed malicious scripts. The stored nature means payloads persist server-side. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, score 5.4) reflects network accessibility, low attack complexity, requirement for low privilege and user interaction, and scope change—the latter indicating the impact extends beyond the vulnerable component to affect other users.

Business impact

Organizations using vulnerable AEM instances face credential theft, session hijacking, and malware distribution risks. Attackers can target high-value users (admins, executives) through persistent malicious content. Compliance implications arise if customer data is exfiltrated through XSS payloads. Remediation delays compound risk as the vulnerability persists across sessions and affects multiple users viewing the same content.

Affected systems

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04, and all earlier versions are vulnerable. Organizations should verify their exact AEM version and service pack level. The vulnerability affects both on-premises and cloud deployments of these versions.

Exploitability

Exploitation requires low-level authentication and relies on a user visiting a page containing the injected payload. No complex exploitation techniques are necessary; standard XSS payloads are effective. The low attack complexity and network accessibility mean opportunistic attackers can readily craft exploits. However, the requirement for user interaction (UI:R) means automated worm-like propagation is constrained. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Upgrade Adobe Experience Manager to a patched version released by Adobe addressing this issue. Organizations must verify the specific patch version from Adobe's security advisory. Until patching is feasible, restrict form field access to trusted internal users only, disable public form submission where possible, and implement Web Application Firewall rules to detect XSS patterns in form inputs.

Patch guidance

Consult Adobe's official security bulletin for CVE-2026-47944 to identify the exact patched version for your AEM release line (6.5, LTS, or 2026 track). Test patches in a non-production environment before deployment. Prioritize production systems accessible to external users or handling sensitive data. Adobe typically releases patches through their standard update channels; verify against the vendor advisory for your specific configuration.

Detection guidance

Search application logs and request patterns for unusual JavaScript payloads in form field submissions and stored content. Monitor for XSS signatures in request bodies targeting form parameters. Review web server logs for atypical script tags or encoded payloads in POST requests. Implement DOM-based XSS detection in browser console logs if user complaints suggest malicious behavior. Query the AEM repository for suspicious script content in affected form components. Security scanning tools with XSS detection can identify persisted payloads if executed against the application.

Why prioritize this

Though CVSS 5.4 (MEDIUM) suggests moderate urgency, stored XSS affecting multi-user environments warrants swift remediation. The scope change and persistence mean a single injection compromises many users. Low barrier to exploitation (low-privileged user, standard attack) and lack of complex prerequisites amplify real-world risk. Organizations with externally-facing AEM forms should prioritize patching ahead of internal-only deployments.

Risk score, explained

The CVSS 5.4 score reflects that while impact is limited to confidentiality and integrity (no availability loss) and requires user interaction, the vulnerability is easy to exploit (low AC, no special privileges beyond basic auth), network-accessible, and crosses privilege boundaries (scope changed). The persistence and multi-user impact justify treating this as higher risk than the base score alone suggests in practical security planning.

Frequently asked questions