CVE-2025-47096: Adobe Experience Manager · Improper Input Validation
Affects Adobe Experience ManagerSource CVE Database V5
Not known to be exploited · CVSS 3.5 Low.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 28% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 10 Jun 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Adobe Adobe Experience Manager | Affected
| Fixed in– |
AI-suggested
- Monitor Adobe’s official security advisories closely for the release of patches addressing CVE-2025-47096 and apply updates promptly once available.
- Implement strict input validation and sanitization controls on all user-supplied data within AEM environments to reduce the risk of malicious content bypassing security features.
- Employ web application firewalls (WAFs) with custom rules to detect and block suspicious input patterns targeting AEM components.
- Conduct user awareness training to reduce the risk of successful social engineering or phishing attacks that could trigger the required user interaction for exploitation.
- Restrict low-privilege user capabilities within AEM to the minimum necessary, limiting the potential impact of compromised accounts.
- Regularly audit and monitor AEM logs for unusual activities or attempts to interact with potentially malicious content.
- Consider network segmentation to isolate AEM servers from less trusted network zones, reducing exposure to external threats.
- Employ multi-factor authentication (MFA) for all users accessing AEM to further reduce the risk of account compromise.
Description
Adobe Experience Manager versions 6.5.22 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass, allowing a low impact to the integrity of the component. Exploitation of this issue requires user interaction in that a victim must interact with the malicious content. Low privileges are required.