CVE-2026-75643 Overview
CVE-2026-75643 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM). A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in the browser of any user who later views the affected page. The weakness is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
The vulnerability requires user interaction and low attacker privileges, but the scope is changed. This means injected scripts can affect resources beyond the security context of the vulnerable component, including sessions of higher-privileged AEM users who browse the tampered content.
Critical Impact
A low-privileged attacker can persistently inject JavaScript that executes in the browsers of other AEM users, enabling session theft, forced actions in the AEM console, and content tampering.
Affected Products
- Adobe Experience Manager (see Adobe Security Advisory APSB26-98 for affected versions)
- Adobe Experience Manager Cloud Service deployments referenced in APSB26-98
- Adobe Experience Manager on-premise instances referenced in APSB26-98
Discovery Timeline
- 2026-09-08 - CVE-2026-75643 published to the National Vulnerability Database (NVD)
- 2026-09-09 - Last updated in the NVD database
Technical Details for CVE-2026-75643
Vulnerability Analysis
CVE-2026-75643 is a stored XSS flaw in AEM form-field handling. AEM accepts author-supplied input into form fields but fails to properly neutralize script content before rendering the field back to viewers. The malicious payload persists in AEM's content repository and executes each time a user renders the affected page.
Because the scope is changed, script execution crosses the security boundary of the vulnerable component. An attacker with author-level access can target administrators or end users who load the compromised page. Successful exploitation can result in session hijacking, unauthorized actions inside the AEM authoring environment, defacement of published content, and pivot into downstream systems that trust AEM sessions.
Root Cause
The root cause is missing or insufficient output encoding on form-field content rendered by AEM components. Input containing HTML or JavaScript is stored verbatim in the Java Content Repository (JCR) and later emitted into the HTML response without HTML-entity encoding or context-aware sanitization. AEM's HTL/Sightly templating provides context-aware escaping, but the affected component paths do not apply it to these form fields.
Attack Vector
The attack vector is network-based and requires authenticated access with low privileges, such as a content author role. The attacker submits a payload containing JavaScript, for example inside an event handler attribute or a <script> tag, into a form field that is later rendered on a page. User interaction is required: a victim must browse to the page hosting the stored payload. When the page loads, the browser parses and executes the attacker-controlled script under the origin of the AEM instance.
No verified public exploit code has been published for CVE-2026-75643. For technical specifics, see the Adobe Security Advisory APSB26-98.
Detection Methods for CVE-2026-75643
Indicators of Compromise
- Form-field values in the JCR containing <script>, javascript: URIs, or inline event handlers such as onerror= or onload=
- Unexpected outbound requests from authoring or publishing sessions to attacker-controlled domains shortly after page load
- Author accounts modifying form components outside of their normal working hours or scope
- New or altered pages containing HTML entities that decode to executable script fragments
Detection Strategies
- Query the JCR for stored properties on form components that match XSS payload patterns, including HTML-encoded and Unicode-escaped variants
- Review AEM access logs for POST requests to /content/ and /libs/ paths that carry script-like payloads in field parameters
- Correlate browser-side Content Security Policy (CSP) violation reports with page URLs served by AEM to identify injected inline scripts
Monitoring Recommendations
- Enable and centralize AEM request.log, audit.log, and dispatcher logs in a SIEM for pattern-based alerting on XSS payload signatures
- Monitor privileged AEM session activity for anomalous administrative actions that follow a page load, which can indicate script-driven account abuse
- Track changes to form-component templates and author group membership so that suspicious authoring activity is flagged for review
How to Mitigate CVE-2026-75643
Immediate Actions Required
- Apply the AEM security update referenced in Adobe Security Advisory APSB26-98 to all authoring and publishing instances
- Audit existing content for stored payloads in form fields and remove or sanitize any suspicious values before republishing
- Rotate session tokens and credentials for accounts that may have viewed a compromised page in the authoring environment
- Restrict author-level accounts to the minimum set of users required for content operations
Patch Information
Adobe published the fix in advisory APSB26-98. Apply the vendor-supplied service pack or hotfix to affected AEM versions. For AEM as a Cloud Service, confirm that instances are running on the release version specified in the advisory.
Workarounds
- Deploy a strict Content Security Policy that disallows inline scripts and unsafe event handlers on AEM-served pages
- Configure the AEM dispatcher and any upstream web application firewall to filter script tags, javascript: URIs, and event-handler attributes in form-field parameters
- Enforce context-aware output encoding in custom HTL/Sightly components that render user-supplied form-field values
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
