CVE-2025-47054: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager (AEM) versions 6.5.22 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability identified as CVE-2025-47054. The vulnerability was discovered and disclosed on August 20, 2025, affecting both on-premise installations and AEM cloud services (NVD).

The vulnerability is classified as a DOM-based Cross-Site Scripting (XSS) issue with a CVSS v3.1 base score of 5.4 (Medium). The attack vector is network-based (AV:N), with low attack complexity (AC:L), requiring low privileges (PR:L) and user interaction (UI:R). The scope is changed (S:C) with low impacts on both confidentiality and integrity (C:L, I:L) and no impact on availability (A:N) (NVD).

If exploited, this vulnerability allows an attacker to execute malicious JavaScript within the context of the victim's browser. The successful exploitation could lead to theft of sensitive browser-based data, session hijacking, or other client-side attacks (NVD).

The vulnerability requires a low-privileged attacker to manipulate the DOM environment and requires user interaction, specifically that a victim must visit a specially crafted web page. The attack can be initiated remotely but requires some level of existing privileges (NVD).

Adobe has released security updates to address this vulnerability. Users should upgrade to versions after 6.5.22 for on-premise installations and to version 2025.5.0 or later for AEM cloud service (NVD).