CVE-2026-47954: Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement server-side input validation and output encoding/sanitization for all user-submitted form fields and any stored content to prevent stored XSS payloads from being saved and executed.
Adobe Experience Manager input_validation_and_output_encoding = enable/implement - Compensating control
Deploy a Web Application Firewall (WAF) or application-layer filters with rules to detect and block common XSS payloads targeting AEM form fields; and restrict access to AEM authoring/management interfaces to trusted IPs or internal networks while a patch is unavailable.
- Operational
Scan existing repository and published content for injected script tags or other malicious payloads, remove or sanitize affected items, and monitor logs and application telemetry for signs of exploitation of stored XSS vulnerabilities.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47954?
CVE-2026-47954 has a severity rating of medium, with a score of 5.4.
How do I fix CVE-2026-47954?
To fix CVE-2026-47954, upgrade to Adobe Experience Manager version 6.5.25 or later.
What type of vulnerability is CVE-2026-47954?
CVE-2026-47954 is a stored Cross-Site Scripting (XSS) vulnerability.
Who is affected by CVE-2026-47954?
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by CVE-2026-47954.
How could CVE-2026-47954 be exploited?
An attacker could exploit CVE-2026-47954 by injecting malicious scripts into vulnerable form fields, executing them in a victim's browser.