CVE-2026-75730: Adobe Experience Manager XSS Vulnerability

CVE-2026-75730 Overview

Adobe Experience Manager (AEM) contains a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in vulnerable form fields. A low-privileged authenticated attacker can inject malicious JavaScript that persists on the affected pages. When a victim navigates to a page containing the injected payload, the script executes in their browser session. The vulnerability has a changed scope, meaning the impact extends beyond the vulnerable component to affect other resources under a different security authority. Exploitation requires user interaction from the victim.

Critical Impact
A low-privileged attacker can inject persistent JavaScript into AEM form fields, executing arbitrary script in victim browsers and potentially compromising session data across different security scopes.

Affected Products

Adobe Experience Manager (AEM Cloud Service)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS Service Pack 1 and Service Pack 2

Discovery Timeline

2026-09-08 - CVE-2026-75730 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75730

Vulnerability Analysis

The vulnerability is a stored XSS flaw affecting form field input handling in Adobe Experience Manager. AEM fails to properly neutralize user-supplied script content before persisting it to backend storage. When rendered back to viewers, the stored payload executes as active browser script rather than inert text.

Because the scope is changed, injected script running within the AEM page context can affect resources beyond the vulnerable component. This is characteristic of XSS payloads that leverage the victim's authenticated session against other services, iframes, or single sign-on contexts reachable from the browser.

Exploitation requires the attacker to hold a low-privileged AEM account with permission to submit content into the vulnerable field. It also requires a victim to visit the page hosting the injected payload.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The affected form field accepts and stores raw markup or script tokens without sufficient contextual output encoding. When the stored value is rendered into HTML response bodies, the browser parses it as executable script.

Attack Vector

The attack vector is network-based. An authenticated attacker with low privileges submits a crafted payload into a vulnerable AEM form field. The payload is stored server-side and rendered whenever an authorized user browses to the associated page. Successful exploitation depends on victim interaction, typically navigation to the affected content.

No verified exploitation code or public proof-of-concept is available at this time. Refer to the Adobe Experience Manager Security Advisory for vendor-provided technical details.

Detection Methods for CVE-2026-75730

Indicators of Compromise

Unexpected <script>, javascript:, or event-handler attributes (onerror, onload, onmouseover) stored in AEM content repository nodes tied to form submissions.
Outbound browser requests from AEM-rendered pages to unfamiliar external domains, indicating potential script beaconing or session exfiltration.
Unusual authoring or form-submission activity from low-privileged AEM accounts, especially in bursts or from new source IPs.

Detection Strategies

Review AEM audit logs and JCR content changes for form field values containing HTML tags, encoded script fragments, or protocol handlers such as javascript: and data:.
Deploy a Content Security Policy (CSP) in report-only mode on AEM-delivered pages to surface unexpected inline script execution or third-party script loads.
Correlate web application firewall (WAF) alerts for XSS signatures with AEM authoring endpoints and form submission URLs.

Monitoring Recommendations

Monitor AEM author and publish instances for anomalous POST traffic to form submission endpoints from low-privileged users.
Alert on modifications to content nodes containing script-like tokens using content integrity monitoring.
Track browser-side errors and CSP violation reports originating from AEM domains to identify attempted or successful script execution.

How to Mitigate CVE-2026-75730

Immediate Actions Required

Apply the Adobe security update referenced in advisory APSB26-98 to all affected AEM Cloud Service and AEM 6.5 LTS instances.
Audit existing form field content for stored HTML or script fragments and sanitize or remove suspicious entries.
Review low-privileged AEM account activity for indicators of malicious content submission.

Patch Information

Adobe has published patch guidance in security bulletin APSB26-98. Administrators should update AEM Cloud Service to the latest release channel and apply the corresponding service pack update for AEM 6.5 LTS deployments. Full details are available in the Adobe Experience Manager Security Advisory.

Workarounds

Enforce a strict Content Security Policy on AEM-rendered pages to block inline script execution and unauthorized script sources.
Restrict form-authoring and content-submission permissions to trusted accounts only, reducing the pool of potential attackers.
Place a web application firewall in front of AEM instances with XSS filtering rules tuned to inspect form field input.

bash

# Configuration example: CSP header to restrict inline script execution on AEM pages
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"