CVE-2026-75644: Adobe Experience Manager XSS Vulnerability

CVE-2026-75644 Overview

CVE-2026-75644 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM). A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The injected script executes in the browser of any user who later views the affected page.

The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). It has a changed scope, meaning the impact extends beyond the vulnerable component to other security authorities in the browser context. Exploitation requires user interaction, typically a victim navigating to the compromised page.

Critical Impact
A low-privileged attacker can persist malicious JavaScript in AEM form fields and execute it in the context of any visitor's browser session, enabling session theft, credential harvesting, or unauthorized actions on behalf of the victim.

Affected Products

Adobe Experience Manager (AEM) — see Adobe Security Advisory APSB26-98 for affected versions
Adobe Experience Manager Cloud Service deployments referenced in the advisory
Adobe Experience Manager on-premises installations covered by APSB26-98

Discovery Timeline

2026-09-08 - CVE-2026-75644 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75644

Vulnerability Analysis

Adobe Experience Manager fails to properly neutralize user-supplied input rendered inside form fields. An attacker with low privileges submits input containing JavaScript payloads, and AEM stores the payload without sufficient sanitization or output encoding. When another user browses the page containing the affected field, the browser executes the script in the context of the AEM origin.

Because the CVSS scope is marked as changed, the injected script can affect resources beyond the vulnerable component. In practice, this means the payload can influence other browser security contexts such as parent frames, sibling origins loaded through the AEM interface, or authenticated sessions in adjacent applications.

The confidentiality and integrity impacts are rated low individually, but stored XSS in a content management platform is well-suited to session hijacking, phishing overlays, and unauthorized content modification within the trust boundary of the affected AEM instance.

Root Cause

The root cause is missing or incomplete output encoding of stored form field data before rendering it into HTML responses. AEM accepts attacker-controlled content, persists it in a data store, and later reflects it into the DOM without contextual escaping appropriate for the HTML sink.

Attack Vector

The attack vector is network-based and requires the attacker to hold an authenticated account with permission to submit or edit form field content. The attacker injects a JavaScript payload into a vulnerable field. When an administrator, editor, or visitor with a valid session loads the affected page, the payload executes and can exfiltrate cookies, tokens, or perform actions permitted to that user.

No verified public proof-of-concept code is available for CVE-2026-75644. Refer to the Adobe Security Advisory APSB26-98 for vendor-supplied technical detail.

Detection Methods for CVE-2026-75644

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event handler attributes (onerror, onload, onmouseover) persisted inside AEM form field content
Outbound requests from user browsers to unknown domains immediately after loading AEM-rendered pages, indicating token or cookie exfiltration
AEM audit log entries showing form field edits by low-privileged accounts followed by anomalous administrative activity

Detection Strategies

Review AEM content repositories for stored HTML or JavaScript patterns inside form field properties that are not expected to contain markup
Deploy Content Security Policy (CSP) reporting to capture violations generated by injected inline scripts on AEM-served pages
Correlate authentication events, form submission events, and subsequent session activity to identify credential replay from stolen tokens

Monitoring Recommendations

Monitor AEM access logs for POST or PUT requests containing encoded script fragments targeting form endpoints
Alert on new or modified form components authored by accounts that do not normally perform content authoring
Track browser-side CSP violation reports and Web Application Firewall (WAF) events flagging reflected or stored XSS signatures against AEM hosts

How to Mitigate CVE-2026-75644

Immediate Actions Required

Apply the security update referenced in Adobe Security Advisory APSB26-98 to all affected AEM instances
Audit low-privileged AEM accounts and revoke unnecessary form authoring permissions to reduce the attack surface
Review recently modified form field content for stored payloads and remove any unauthorized script content before serving pages to end users

Patch Information

Adobe has released fixed versions of Adobe Experience Manager as documented in Adobe Security Bulletin APSB26-98. Administrators should consult the advisory for the specific versions and channels that resolve CVE-2026-75644, and schedule an upgrade cycle across production and lower environments.

Workarounds

Enforce a strict Content Security Policy on AEM-served pages that disallows inline scripts and restricts script sources to trusted origins
Deploy a WAF rule set that inspects form field submissions for HTML tags and JavaScript event handlers before they reach AEM
Restrict form authoring capabilities to a minimal set of trusted accounts and require multi-factor authentication for those roles

bash

# Example Content Security Policy header for AEM responses
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report