CVE-2026-75729: Adobe Experience Manager XSS Vulnerability

CVE-2026-75729 Overview

CVE-2026-75729 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in Adobe Experience Manager (AEM). A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when the victim loads a page containing the affected field. The scope is changed, meaning the injected script can impact resources beyond the vulnerable component. Adobe published a fix in security advisory APSB26-98.

Critical Impact

Stored XSS enables session hijacking, credential theft, and unauthorized actions in the context of any AEM user who views injected content, including higher-privileged administrators.

Affected Products

• Adobe Experience Manager (AEM Cloud Service)
• Adobe Experience Manager 6.5 LTS (base release)
• Adobe Experience Manager 6.5 LTS SP1 and SP2

Discovery Timeline

• 2026-09-08 - CVE-2026-75729 published to the National Vulnerability Database
• 2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75729

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw in Adobe Experience Manager form field handling. AEM stores attacker-supplied input in the repository without adequate output encoding. When another user renders a page that includes the persisted field value, the browser interprets the injected markup as executable JavaScript. Because the scope changes under CVSS, the injected script can reach content owned by other AEM components or users, extending the blast radius beyond the original form. Exploitation requires low privileges and user interaction, which fits authenticated content-authoring workflows typical of AEM deployments.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79] in one or more AEM form field handlers. Field values persisted through authenticated authoring endpoints are re-rendered without HTML entity encoding or context-aware sanitization. Attacker-controlled markup, including <script> tags and event handlers, survives the storage and rendering pipeline intact.

Attack Vector

An attacker with a low-privileged AEM author account submits a payload such as an event-handler attribute or a script tag into a vulnerable form field. The malicious value is stored in the JCR repository. When a victim, typically an editor, reviewer, or administrator, navigates to a page that renders the field, the script runs in the victim's browser session against the AEM origin. The attacker can steal session cookies, perform CSRF-style actions using the victim's privileges, or pivot toward higher-privileged accounts.

No verified exploitation code is publicly available. See the Adobe Security Advisory APSB26-98 for vendor-specific technical details.

Detection Methods for CVE-2026-75729

Indicators of Compromise

• Persisted form field values containing <script>, javascript:, or event-handler attributes such as onerror=, onload=, or onmouseover=.
• Unexpected outbound HTTP requests from authenticated author or preview sessions to attacker-controlled domains.
• Anomalous JCR node modifications by low-privileged author accounts touching fields not typically edited by that user.

Detection Strategies

• Review AEM request.log and audit.log for POST requests writing HTML or script content to form-backed properties.
• Query the JCR for stored property values that match XSS payload patterns using AEM's QueryBuilder or Groovy console.
• Correlate author-tier writes with dispatcher-tier renders that trigger browser-side script execution alerts from a web proxy or CSP report-uri endpoint.

Monitoring Recommendations

• Enable and forward AEM access, request, and audit logs to a centralized analytics platform for retention and correlation.
• Deploy a Content Security Policy with report-uri or report-to directives to surface unexpected inline script execution.
• Monitor privileged AEM account sessions for anomalous actions initiated shortly after viewing author-generated content.

How to Mitigate CVE-2026-75729

Immediate Actions Required

• Apply the Adobe security update referenced in APSB26-98 to AEM Cloud Service and AEM 6.5 LTS instances.
• Audit existing form-backed content nodes for persisted script payloads and remove or sanitize any malicious values.
• Review and tighten group memberships for author-tier accounts to enforce least privilege.

Patch Information

Adobe published fixes in advisory APSB26-98, covering Adobe Experience Manager Cloud Service and AEM 6.5 LTS releases including the base 6.5 LTS, SP1, and SP2 branches. Administrators should apply the vendor-listed service pack or cumulative fix pack that corresponds to their deployment channel.

Workarounds

• Restrict authoring access to trusted users until the patch is applied, reducing the pool of accounts able to submit stored payloads.
• Enforce a strict Content Security Policy on AEM-published sites to block inline script execution and unauthorized script sources.
• Deploy a web application firewall rule set on the AEM dispatcher tier to filter script tags and event-handler attributes in form submissions.

# Configuration example: sample CSP header for AEM dispatcher (Apache)
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report"