CVE-2025-47076: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2025-47076. The vulnerability was discovered and initially reported to Adobe Systems Incorporated, with the CVE record being created on April 30, 2025, and published to the National Vulnerability Database (NVD) on June 10, 2025 (NVD, CVE).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue (CWE-79) affecting form fields within Adobe Experience Manager. It has received a CVSS v3.1 base score of 5.4 (Medium), with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This scoring indicates that the vulnerability requires low privileges and user interaction, with network access being possible (NVD, Wiz).

When successfully exploited, this vulnerability allows attackers to inject malicious scripts into vulnerable form fields. The injected JavaScript code can then be executed in victims' browsers when they access the page containing the compromised field. This can lead to potential data theft and compromise of user sessions (Wiz).

Adobe has released security updates to address this vulnerability. Users are advised to upgrade to versions newer than 6.5.22 to mitigate the risk (Adobe Security).