CVE-2026-75731: Adobe Experience Manager XSS Vulnerability

CVE-2026-75731 Overview

CVE-2026-75731 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM). A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they load the page containing the affected field. The vulnerability has a changed scope, meaning the injected script can affect resources beyond the vulnerable component.

Critical Impact
An authenticated attacker with low privileges can persist malicious JavaScript in AEM form fields, enabling session hijacking, credential theft, and unauthorized actions in the context of any user who views the affected content.

Affected Products

Adobe Experience Manager Cloud Service (aem_cloud_service)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS SP1 and SP2

Discovery Timeline

2026-09-08 - CVE-2026-75731 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75731

Vulnerability Analysis

The flaw is a stored XSS issue [CWE-79] in Adobe Experience Manager. AEM fails to properly sanitize input submitted to certain form fields before rendering the value back into HTML output. An attacker with low-privilege authenticated access can supply JavaScript payloads that AEM persists in the underlying content repository.

When a legitimate user later browses a page that renders the tainted field, their browser parses the stored payload as executable script. Because scope is changed, the injected script can act against resources outside the security boundary of the vulnerable component. User interaction is required, since the victim must load the affected page.

The consequences include theft of session cookies, capture of authentication tokens, arbitrary requests issued on behalf of the victim, and defacement of AEM-authored content. In an authoring environment, a script executing in an administrator's session can pivot to broader content manipulation.

Root Cause

The root cause is missing or insufficient output encoding of user-controlled form field data. Untrusted input is stored in the JCR repository and later rendered without contextual HTML or JavaScript escaping, violating output-encoding requirements for web applications.

Attack Vector

Exploitation occurs over the network against an AEM instance where the attacker holds low-privilege credentials, such as a content author account. The attacker submits a crafted payload through a vulnerable form field, and the payload triggers when any user, including higher-privileged administrators, views the rendered page. Exploitation requires user interaction with the affected page.

No public proof-of-concept or in-the-wild exploitation has been reported. The EPSS probability is 0.271%.

Detection Methods for CVE-2026-75731

Indicators of Compromise

AEM form field values containing <script>, javascript:, onerror=, onload=, or encoded variants such as <script>.
Outbound requests from AEM author or publish nodes to unfamiliar domains referenced by rendered pages.
Unexpected changes to page or form content authored by low-privileged accounts.
Anomalous cookie or token exfiltration patterns in web proxy logs originating from AEM-hosted pages.

Detection Strategies

Review JCR content for stored HTML or script fragments within properties that should contain plain text using AEM's Query Builder or JCR SQL2 queries.
Deploy web application firewall rules that inspect POST bodies to AEM form endpoints for common XSS patterns.
Enable Content Security Policy reporting to surface script execution from unexpected origins on AEM-rendered pages.

Monitoring Recommendations

Audit AEM access.log and request.log for repeated POST activity from low-privileged users targeting form components.
Correlate author-account activity with content property changes in the Sling audit log.
Alert on script tags or event handler attributes appearing in fields flagged as text-only in the component definition.

How to Mitigate CVE-2026-75731

Immediate Actions Required

Apply the Adobe Experience Manager security update referenced in the Adobe Security Advisory APSB26-98.
Inventory all AEM 6.5 LTS deployments, including SP1 and SP2, and confirm Cloud Service instances are running a patched release.
Rotate session tokens and administrative credentials if suspicious form submissions are identified during triage.
Restrict the assignment of content-authoring privileges to the minimum set of trusted users.

Patch Information

Adobe published fixes in security bulletin APSB26-98. Refer to the Adobe Security Advisory APSB26-98 for the specific patched versions of AEM 6.5 LTS and the Cloud Service release notes.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Configure the Sling XSS Protection API and enable strict output encoding for custom components rendering user input.
Place a web application firewall in front of AEM author instances and block requests containing script tags or JavaScript event handlers in form parameters.
Temporarily restrict access to affected form components until the patch is deployed.

bash

# Example WAF rule (ModSecurity) to block script payloads in AEM form submissions
SecRule REQUEST_URI "@beginsWith /content/" \
  "chain,phase:2,deny,status:403,id:1075731,msg:'Potential AEM stored XSS payload'"
  SecRule ARGS "@rx (?i)(<script|javascript:|onerror\s*=|onload\s*=)" \
    "t:none,t:urlDecodeUni,t:htmlEntityDecode"