CVE-2026-47990: Stored XSS in Adobe Experience Manager 6.5, LTS SP1, 2026.04

Technical summary

CVE-2026-47990 is a stored XSS flaw (CWE-79) in Adobe Experience Manager that permits authenticated users with low privilege to inject arbitrary JavaScript into vulnerable form fields. The injected payload persists in the application's database and executes client-side whenever any user navigates to or views a page containing the compromised field. The scope change indicated in the vulnerability description suggests the attack can impact security domains or user contexts beyond the attacker's direct privilege level, amplifying lateral risk within AEM deployments.

Business impact

Organizations running affected AEM instances face session hijacking, credential theft, malware distribution, and reputational damage if attackers use the vulnerability to compromise trusted internal or customer-facing portals. Given that the attack requires only low-privilege access—such as a content editor or form contributor role—the risk is elevated for enterprises with distributed authoring teams. Stored XSS is difficult to detect and remediate after infection, potentially affecting many users before discovery.

Affected systems

Adobe Experience Manager versions 6.5.24, LTS SP1, and 2026.04 and earlier are vulnerable. Organizations should inventory all AEM deployments by version and patch level. Patch version numbers for remediation must be verified against the official Adobe security advisory.

Exploitability

Exploitation requires valid AEM credentials and low privilege (e.g., form editor or contributor role). The attack vector is network-based with low attack complexity, and successful execution depends on a user viewing the compromised page (user interaction required). The CVSS 3.1 score of 5.4 reflects medium severity. Automated scanning tools cannot reliably detect injected payloads without direct inspection of form field data and rendered output; manual code review and content audits are necessary.

Remediation

Apply Adobe's security patch to upgrade AEM beyond the affected versions (6.5.24, LTS SP1, 2026.04). Additionally, conduct a forensic audit of form fields across all AEM instances to identify and remove any malicious payloads. Implement input validation, output encoding, and content security policies (CSP) to prevent future XSS injection. Restrict form editing privileges to trusted users and enable audit logging for all field modifications.

Patch guidance

Contact Adobe support or consult the official Adobe Experience Manager security advisory for the specific patch versions and deployment steps. Patches should be tested in a staging environment before production rollout. Verify patch applicability for your exact AEM version and configuration. Monitor Adobe's security bulletins for cumulative updates that may address this and related vulnerabilities.

Detection guidance

Monitor AEM access logs and form submission records for unusual changes by low-privilege users. Use web application firewalls (WAF) to detect and block inline script patterns in form submissions. Deploy browser-based content security policy headers to mitigate XSS execution. Review form field audit trails for unexpected modifications, especially outside normal business hours. Penetration testers should include stored XSS validation in AEM assessment scope, focusing on custom and standard form components.

Why prioritize this

Although the CVSS score is medium (5.4), stored XSS in a content management platform merits expedited remediation because the flaw affects trusted content infrastructure and can compromise many users passively. The low barrier to entry (basic user access) and scope change (cross-context impact) increase practical risk. Organizations with public-facing or multi-tenant AEM deployments should prioritize this higher than the numeric score alone suggests.

Risk score, explained

The CVSS 3.1 score of 5.4 (MEDIUM) is driven by network-based attack vector, low complexity, and requirement for low privilege and user interaction. Confidentiality and integrity are degraded (L/L) but availability is unaffected (N). The scope change (S:C) acknowledges that the vulnerability can impact contexts beyond the attacker's privilege level, preventing a lower score. For many organizations, the practical risk is elevated due to the persistent nature of stored XSS and the trust users place in content served by AEM.

Frequently asked questions