CVE-2026-47977: Adobe Experience Manager Stored XSS Vulnerability—Patch Guidance & Detection

Technical summary

CVE-2026-47977 is a stored XSS vulnerability (CWE-79) affecting Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04, and earlier. The flaw exists in form field handling and allows authenticated attackers with low privileges to inject malicious scripts. When a victim accesses a page containing the injected payload, the JavaScript executes in their browser context with the victim's privileges. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) reflects network-accessible attack surface, low complexity, requirement for login credentials, user interaction dependency, and cross-site scope change—indicating the payload can affect resources and sessions beyond the immediate form.

Business impact

Stored XSS in Experience Manager poses data exfiltration and session hijacking risks. Attackers can steal authenticated user session cookies, capture sensitive form submissions, or redirect users to credential-harvesting sites. For organizations using AEM for customer-facing portals or internal workflows, this threatens customer trust, regulatory compliance (especially in financial or healthcare contexts), and operational integrity. The 'scope changed' element in CVSS indicates potential to compromise connected systems or user trust boundaries.

Affected systems

The vulnerability affects Adobe Experience Manager versions 6.5.24 (and presumably earlier 6.5.x releases), LTS SP1, and 2026.04 (and presumably earlier versions in the 2026.x line). Organizations must identify all AEM instances in their environment, confirm version against the affected ranges, and prioritize systems hosting customer-facing or data-sensitive content.

Exploitability

Exploitation requires valid AEM credentials and low privilege level—meaning any authenticated user, including those with minimal administrative rights, can inject malicious code. The barrier to weaponization is low for insiders or attackers with valid accounts. External exploitation paths depend on AEM authentication architecture and whether account creation or password reset mechanisms are accessible. User interaction (visiting a page with the payload) is required for the attack to succeed, making social engineering or internal distribution tactics relevant. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the last update.

Remediation

Apply Adobe's patched versions for your AEM deployment. For AEM 6.5.x environments, upgrade to the fixed 6.5.25 or later (verify against Adobe's official advisory for exact patch version). For LTS SP1 and 2026.04 lineages, follow Adobe's guidance to the appropriate patched release. Interim mitigations include implementing Web Application Firewall (WAF) rules to detect XSS payloads in form submissions, enforcing strict Content Security Policy (CSP) headers, and reviewing form field access controls to limit who can author or modify form content.

Patch guidance

Check Adobe's official security advisories for the exact patched version corresponding to your AEM release line. Patches are typically cumulative service packs or hotfixes. Before patching production systems, test in a staging environment to verify compatibility with custom code and extensions. Schedule patching promptly given the low barrier to exploitation; consider prioritizing systems accessible to external users or handling sensitive data.

Detection guidance

Hunt for suspicious JavaScript in AEM form field configurations using automated scanning or manual code review. Monitor AEM audit logs for form field creation or modification by low-privileged users, particularly outside normal change windows. Inspect browser developer consoles for unexpected script execution when accessing AEM forms. Deploy SIEM detection for anomalous session behavior post-form submission (unusual API calls, data exfiltration patterns). Content Security Policy violation logs can signal XSS attempts if CSP is enforced.

Why prioritize this

Although rated MEDIUM severity (5.4 CVSS), this vulnerability warrants prompt patching because stored XSS persistence affects all future visitors, low-privileged users can exploit it, and scope change indicates risk to downstream systems. Organizations relying on AEM for customer engagement should treat this as high-priority. Risk tier rises if AEM hosts payment forms, personal data collection, or internal employee workflows.

Risk score, explained

CVSS 5.4 MEDIUM reflects a network-accessible, low-complexity attack requiring login and user interaction, with limited direct confidentiality and integrity impact. However, the stored nature, low privilege bar, and scope-change element mean blast radius and persistence are higher than many MEDIUM-rated flaws. Context matters: customer-facing AEM deployments face greater risk than isolated internal instances.

Frequently asked questions