CVE-2026-47974: Adobe Experience Manager Stored XSS Vulnerability

Technical summary

CVE-2026-47974 is a stored XSS flaw (CWE-79) in Adobe Experience Manager that enables low-privileged attackers to persist malicious JavaScript payloads in vulnerable form fields. The attack requires user interaction—a victim must browse to the page containing the injected payload—at which point the JavaScript executes in the victim's security context. The scope change (S:C in the CVSS vector) indicates the vulnerability can impact confidentiality and integrity beyond the attacker's normal authorization boundary. Affected versions include 6.5.24, LTS SP1, 2026.04, and earlier releases.

Business impact

Organizations using vulnerable AEM versions face session hijacking, credential theft, malware distribution, and defacement risks. Because the vulnerability requires only low-privilege access, internal threats or compromised contractor accounts become meaningful attack vectors. Customer-facing content delivery through AEM could be weaponized to target visitors. Regulatory exposure exists if user data is exfiltrated through XSS payloads. Recovery requires identifying all injected form fields, notifying affected users, and potentially resetting sessions and credentials.

Affected systems

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are vulnerable. Organizations should audit their deployed AEM versions immediately. Any instance allowing user-generated content or form submissions is at risk. On-premises and cloud-hosted deployments are both affected.

Exploitability

Exploitation is straightforward and requires only low-privilege user credentials to access form fields. No special network position or advanced technique is needed. The barrier to exploitation is the user interaction requirement—an attacker must trick or wait for a victim to view the compromised page. Once a payload is stored, it poses persistent risk to all subsequent visitors. This makes it an attractive vector for internal attackers or those targeting high-traffic pages.

Remediation

Patch affected AEM instances to versions released after 2026.04 as provided by Adobe. For environments where immediate patching is constrained, implement input validation and output encoding rules at the form field level, disable JavaScript execution in user-controlled content, and restrict form field editing to trusted administrators only. Monitor access logs for suspicious form field modifications.

Patch guidance

Obtain the latest security patch from Adobe for your specific AEM version (6.5.x, LTS SP1, or 2026.x track). Adobe typically provides patches within their regular update cycle; verify availability on the Adobe Security Advisory page. After patching, test forms in a staging environment to confirm functionality is preserved. Coordinate deployments to minimize service interruption.

Detection guidance

Search AEM form field content for script tags, event handlers (onclick, onerror, onload), and encoded payloads (e.g., %3cscript%3e patterns). Review audit logs for form field modifications by low-privilege accounts. Monitor for unusual JavaScript execution in user sessions following form page navigation. Use web application firewalls to log and block XSS patterns in form submissions. Consider Content Security Policy headers to restrict inline script execution.

Why prioritize this

Although the CVSS score is moderate (5.4), the combination of low attack complexity, persistent storage, scope change, and low barrier to entry justifies swift remediation. Internal threat scenarios and supply-chain risk (compromised partners injecting malicious content) elevate practical risk above the numerical score. Organizations with public-facing AEM deployments should prioritize this higher.

Risk score, explained

The CVSS 3.1 score of 5.4 (MEDIUM) reflects the requirement for low-privilege access and user interaction, which limit immediate impact. However, the scope change (S:C) and potential for broad confidentiality and integrity compromise warrant closer examination. The score does not account for reputational damage or regulatory consequences of content defacement or customer data theft via XSS.

Frequently asked questions