CVE-2026-47947: Adobe Experience Manager DOM-Based XSS Vulnerability – CVSS 5.4

Technical summary

This is a DOM-based XSS vulnerability (CWE-79) in Adobe Experience Manager that arises from improper sanitization of user-controlled input reflected in the browser's DOM. The vulnerability has a CVSS v3.1 score of 5.4 (MEDIUM) with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The attack surface is network-accessible, requires low attack complexity, mandates prior authentication (PR:L), and depends on user interaction to trigger. The 'Scope Changed' designation indicates that compromised context can affect resources beyond the vulnerable component. Affected versions include 6.5.24, LTS SP1, 2026.04, and earlier releases.

Business impact

Organizations running AEM for digital asset management, content publishing, or multi-tenant customer portals face potential unauthorized content modification, data exfiltration, and privilege abuse. Authenticated users—including content editors, marketers, and administrators—could be tricked into visiting malicious links that hijack their sessions. In multi-tenant environments, an attacker exploiting this against one user could potentially pivot to affect other users' content or workflows. The medium severity score reflects the need for user interaction and authentication, but the changed scope and ability to modify content warrant prompt attention in environments handling sensitive or revenue-critical digital properties.

Affected systems

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04, and all earlier versions are vulnerable. Organizations should audit their current AEM deployment version immediately. Adobe typically provides separate update tracks for stable releases and long-term support (LTS) versions, so patch availability and timelines may differ by release line. Verify your exact version via the AEM console and cross-reference against the vendor advisory for applicable fixes.

Exploitability

The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no widespread active exploitation has been reported as of the publication date. However, the simplicity of DOM-based XSS attacks and the high user interaction likelihood in AEM environments make this a realistic threat. Attackers could craft phishing emails or compromise legitimate websites to host malicious payloads, lowering the barrier to exploitation. The requirement for prior authentication means only users with AEM access are at risk, which typically limits the blast radius but does not eliminate it for organizations with broad user bases.

Remediation

Apply the security patch from Adobe as soon as it becomes available for your specific AEM version and service pack. Adobe typically releases patches through their regular maintenance release cycles. Until patching is complete, restrict AEM access to trusted networks, enforce strong authentication controls (multi-factor authentication where possible), and educate users about the risks of clicking untrusted links while logged into AEM. Content Security Policy (CSP) headers may provide defense-in-depth, though they are not a substitute for patching.

Patch guidance

Contact Adobe support or consult the Adobe Experience Manager security bulletin for your specific version line (6.5, LTS SP1, 2026.04) to obtain the patched release. Test patches in a non-production environment before rolling out to live systems, as AEM updates can affect plugin compatibility and content workflows. Verify that the patch version number is listed as addressing CVE-2026-47947. Maintain a documented schedule for applying patches across all AEM instances in your organization.

Detection guidance

Monitor web application firewalls (WAFs) and AEM logs for DOM manipulation attempts, unusual JavaScript execution, and requests containing JavaScript payloads in query parameters or POST data. Anomalous behavior by authenticated AEM users—such as sudden content modifications outside normal workflows or access to sensitive administrative functions—may indicate session hijacking. Use browser security tooling and Content Security Policy violation reports to detect XSS attempts. Log authentication events and user actions for forensic review if a compromise is suspected.

Why prioritize this

Although the CVSS score is MEDIUM and no public exploitation exists, this vulnerability merits prompt prioritization because: (1) DOM-based XSS in content management platforms can directly undermine organizational credibility if malicious content is published; (2) affected versions are widely deployed in enterprise environments; (3) the changed scope increases risk in shared or multi-tenant settings; and (4) authentication requirement does not reduce risk proportionally in organizations with large AEM user bases. Prioritize environments where AEM is customer-facing or handles high-value digital assets.

Risk score, explained

The CVSS v3.1 score of 5.4 (MEDIUM) reflects: Network attack vector (widely exploitable), low attack complexity (straightforward XSS payload delivery), and required user authentication and interaction (reducing likelihood). The 'Scope Changed' component elevates concern beyond the typical impact of a user-initiated XSS, as the compromised AEM context can affect broader application resources. Integrity and Confidentiality are impacted at low levels, with no availability impact expected. The score appropriately captures a real but not catastrophic risk; however, organizational context—such as AEM's role in your workflow and the sensitivity of managed assets—should inform your internal risk assessment.

Frequently asked questions