CVE-2026-75735 Overview
Adobe Experience Manager (AEM) contains a stored Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-75735. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they visit the page containing the affected field. The vulnerability affects multiple AEM editions including AEM Cloud Service and AEM 6.5 LTS releases up to SP2. The scope is changed, meaning the injected script can impact resources beyond the vulnerable component's security context. User interaction is required for exploitation, and the flaw carries limited confidentiality and integrity impact with no direct availability effect.
Critical Impact
Authenticated attackers can inject persistent JavaScript into AEM form fields, enabling session hijacking, credential theft, and unauthorized actions in the context of victim users across security boundaries.
Affected Products
- Adobe Experience Manager (AEM Cloud Service)
- Adobe Experience Manager 6.5 LTS (base release)
- Adobe Experience Manager 6.5 LTS SP1 and SP2
Discovery Timeline
- 2026-09-08 - CVE-2026-75735 published to the National Vulnerability Database
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-75735
Vulnerability Analysis
CVE-2026-75735 is a stored Cross-Site Scripting flaw classified under CWE-79: Improper Neutralization of Input During Web Page Generation. The vulnerability resides in form field handling within Adobe Experience Manager, where user-supplied input is persisted without sufficient output encoding.
When a victim renders a page containing the tainted field, the injected script executes under the origin of the AEM application. The changed scope indicator means the vulnerable component and the impacted component operate under different security authorities. An attacker exploiting this flaw can pivot from a low-privileged content authoring role into actions performed by higher-privileged administrators viewing the affected content.
Root Cause
The root cause is missing or incomplete output sanitization on form field data written by authenticated authors. AEM stores the malicious payload in the repository, and subsequent page renders reflect the untrusted content into the response HTML without contextual escaping. This is a classic persistent XSS pattern where the storage layer preserves attacker markup verbatim.
Attack Vector
Exploitation requires network access to the AEM authoring interface and a valid low-privileged account with permission to edit form fields. The attacker submits a crafted payload containing JavaScript into a vulnerable field. The payload is stored server-side and executes each time a user browses the page. User interaction is required, but this is naturally satisfied by normal content review workflows.
Refer to the Adobe Security Advisory APSB26-98 for vendor-confirmed technical details. No public proof-of-concept exploit code is available at this time.
Detection Methods for CVE-2026-75735
Indicators of Compromise
- Form field content in the AEM repository containing <script>, javascript:, onerror=, onload=, or encoded variants of these constructs
- Unexpected outbound HTTP requests from browsers rendering AEM-authored pages, particularly to attacker-controlled domains
- Author accounts with low privileges performing atypical edits to form components or content fragments
Detection Strategies
- Audit repository nodes backing form components for stored HTML or JavaScript markup that should never appear in text fields
- Correlate content modification events with subsequent browser-side script execution telemetry from endpoint agents
- Deploy Content Security Policy (CSP) reporting endpoints to capture blocked inline script execution attempts on AEM-rendered pages
Monitoring Recommendations
- Enable verbose AEM audit logging for content authoring actions and forward events to a centralized SIEM for correlation
- Monitor for anomalous session activity following visits to newly modified pages, including cookie exfiltration patterns and token replay
- Track Dispatcher and CDN logs for suspicious query strings or response bodies containing script payloads sourced from authored content
How to Mitigate CVE-2026-75735
Immediate Actions Required
- Apply the security updates referenced in Adobe Security Advisory APSB26-98 to all affected AEM Cloud Service and AEM 6.5 LTS instances
- Review and restrict authoring privileges so only trusted users can create or modify form fields
- Audit existing content for stored payloads and remediate any tainted nodes before re-publishing
Patch Information
Adobe has released fixed builds for Adobe Experience Manager Cloud Service and AEM 6.5 LTS. Consult the Adobe Security Advisory APSB26-98 for the specific patched versions and upgrade guidance applicable to your deployment channel.
Workarounds
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
- Configure AEM Dispatcher rules to filter or reject requests containing suspicious payload patterns targeting form endpoints
- Temporarily reduce the set of authors permitted to edit form components until patches are validated and deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
