CVE-2026-47972: Adobe Experience Manager Stored XSS Vulnerability in Form Fields

Technical summary

This is a stored XSS vulnerability (CWE-79) in Adobe Experience Manager where insufficient input sanitization in form field handling allows authenticated users with low privileges to persist malicious JavaScript payloads. The injected scripts execute with the same privileges as the victim viewing the page, and the scope change indicates the vulnerability can affect resources beyond the vulnerable component itself. The attack requires user interaction (viewing the compromised page) but no special network positioning or complex exploitation techniques.

Business impact

Organizations running vulnerable AEM instances face risk of session hijacking, credential theft, and unauthorized actions performed on behalf of legitimate users. Content editors or other low-privileged users could compromise the integrity of published pages without detection. In multi-tenant or partner environments, this could facilitate lateral movement or supply chain attacks. Remediation requires coordinated patching across AEM deployments, potentially affecting content management workflows during updates.

Affected systems

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected. Organizations should inventory their AEM deployments across all instances and service packs to determine exposure scope. The broad version range suggests this may affect both legacy and recently deployed environments.

Exploitability

Exploitation requires valid authentication (PR:L in the CVSS vector), so external attackers cannot directly exploit this flaw. However, the low barrier to entry—any low-privileged user such as a content contributor, editor, or partner account—makes this readily exploitable by insider threats or compromised accounts. Once malicious content is injected, it persists and affects all subsequent viewers without additional attacker interaction, maximizing blast radius.

Remediation

Apply Adobe's security patches for affected AEM versions immediately. Verify patched versions against Adobe's official security advisory. Until patches are applied, implement input validation and output encoding policies at the application level, restrict form field modification permissions to trusted roles only, and consider deploying Web Application Firewalls configured to detect and block suspicious JavaScript patterns in form submissions.

Patch guidance

Consult Adobe's official security advisory for your specific AEM version (6.5.24, LTS SP1, or 2026.04) to identify the correct patch version and installation method. Test patches in a non-production environment first to ensure compatibility with custom extensions or integrations. Coordinate patching across all AEM instances to prevent inconsistent security postures. Verify successful patching by confirming the vulnerability is no longer present in your environment.

Detection guidance

Monitor AEM audit logs for unusual form field modifications, particularly by low-privileged accounts or service accounts. Search HTTP request payloads for JavaScript keywords and common XSS patterns (script tags, event handlers, dangerous protocols) in form field submissions. Review published pages and components for unexpected script tags or suspicious content. Implement Content Security Policy (CSP) headers to restrict script execution and log violations. Test form fields for stored XSS using both automated scanners and manual injection of benign JavaScript markers.

Why prioritize this

Although rated MEDIUM severity, the combination of low authentication barriers, stored persistence, and potential for broad victim exposure across content consumers warrants priority patching. The scope change enlarges the attack surface beyond the vulnerable form field component itself. Organizations should prioritize this based on AEM deployment criticality and the privilege levels of content management accounts.

Risk score, explained

The CVSS 3.1 score of 5.4 (MEDIUM) reflects the requirement for authenticated access (PR:L) and user interaction (UI:R), which limits direct exploitability. However, the stored nature of the XSS and the scope change increase practical risk. The low CVSS is not an indicator that patching can be deferred—stored XSS in content management systems poses significant organizational risk due to persistence and reach.

Frequently asked questions