CVE-2026-47945: Adobe Experience Manager Stored XSS Vulnerability – Patch & Detection Guide

Technical summary

CVE-2026-47945 is a stored XSS vulnerability (CWE-79) in Adobe Experience Manager affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. The flaw exists in form field handling where inadequate input sanitization permits authenticated attackers to persist malicious JavaScript payloads. Upon victim access to the contaminated form, the injected script executes within their security context. The CVSS 3.1 vector (5.4 MEDIUM) reflects low complexity exploitation, low privilege requirement, and changed scope—indicating potential impact beyond the vulnerable component itself.

Business impact

Compromised AEM instances can become vectors for credential theft, unauthorized content manipulation, and lateral movement within connected systems. Marketing and content teams may inadvertently spread malicious payloads to customers or partners accessing published content. Remediation delays increase exposure window; organizations relying on AEM for customer-facing digital experiences face reputational and operational risk if malicious scripts execute during active campaigns.

Affected systems

Adobe Experience Manager versions 6.5.24, LTS SP1, and 2026.04 or earlier are vulnerable. Organizations running any of these versions should enumerate affected instances, prioritizing those with internet-facing authoring or publishing environments and high user traffic.

Exploitability

The vulnerability requires valid user credentials, limiting the attack surface to insider threats or attackers with compromised low-privilege accounts. However, the low attack complexity and requirement for only user interaction (victim browsing the page) make it readily exploitable once access is obtained. No CISA KEV listing indicates this is not yet observed in active exploitation campaigns, but the accessible attack vector warrants prompt attention.

Remediation

Adobe has released patches for affected versions. Organizations should immediately apply updates to versions after 2026.04 and verify patching completeness across all AEM deployments. Additionally, enforce strict content validation policies, implement Web Application Firewall (WAF) rules to detect XSS patterns in form submissions, and conduct user awareness training on recognizing suspicious form behavior.

Patch guidance

Consult Adobe's official security bulletin for CVE-2026-47945 to identify patched versions specific to your deployment (6.5.x, LTS SP1, or 2026.x track). Verify patch versions against the vendor advisory before deployment. Test patches in a non-production environment to ensure compatibility with custom extensions or configurations. Prioritize authoring instances and publicly accessible forms first. Given the low-privilege requirement, ensure the patching applies even to non-administrative user interfaces.

Detection guidance

Search AEM activity logs for unusual form field modifications, especially those containing script tags, encoded JavaScript, or suspicious event handlers. Monitor for unexpected changes to component or template definitions. Implement WAF signatures to block form submissions containing common XSS payloads. Audit recent form submissions to identify injected content and affected content fragments. Use browser developer tools when reviewing published pages to spot unexpected script execution.

Why prioritize this

Although CVSS scores a MEDIUM 5.4, the combination of persistent storage, changed scope, and accessibility to low-privileged users elevates practical risk. Unlike reflected XSS, stored payloads affect all users viewing the page indefinitely until remediated. Organizations with high-traffic customer-facing AEM deployments should treat this as high-priority to prevent brand damage and customer exposure.

Risk score, explained

The CVSS 5.4 MEDIUM rating reflects the attack's requirement for valid credentials (Low PR) and user interaction (UI requirement), balanced against network accessibility and changed scope. The score does not fully capture the persistent nature of stored XSS or reputational impact; internal risk prioritization should consider your organization's user base size, public-facing reliance on AEM, and regulatory obligations around customer data protection.

Frequently asked questions