CVE-2025-47054: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager (AEM) versions 6.5.22 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability identified as CVE-2025-47054. The vulnerability was discovered and disclosed on August 20, 2025, affecting both on-premise installations and AEM cloud services (NVD).

The vulnerability is classified as a DOM-based Cross-Site Scripting (XSS) issue with a CVSS v3.1 base score of 5.4 (Medium). The attack vector is network-based (AV:N), with low attack complexity (AC:L), requiring low privileges (PR:L) and user interaction (UI:R). The scope is changed (S:C) with low impacts on both confidentiality and integrity (C:L, I:L) and no impact on availability (A:N) (NVD).

If exploited, this vulnerability allows an attacker to execute malicious JavaScript within the context of the victim's browser. The successful exploitation could lead to theft of sensitive browser-based data, session hijacking, or other client-side attacks (NVD).

Adobe has released security updates to address this vulnerability. Users should upgrade to versions after 6.5.22 for on-premise installations and to version 2025.5.0 or later for AEM cloud service (NVD).