CVE-2026-75736: Adobe Experience Manager XSS Vulnerability

CVE-2026-75736 Overview

Adobe Experience Manager (AEM) contains a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in form field handling. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when the victim navigates to a page containing the injected field. Because scope is changed, the executed script can affect resources beyond the vulnerable component's security authority, including the victim's browser session. The vulnerability affects both AEM Cloud Service and AEM 6.5 LTS releases through Service Pack 2. Adobe published guidance in security bulletin APSB26-98.

Critical Impact
Authenticated attackers can persist JavaScript payloads in AEM forms that execute against other users' browser sessions, enabling session token theft, credential harvesting, and content manipulation within the AEM authoring environment.

Affected Products

Adobe Experience Manager Cloud Service (AEM as a Cloud Service)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS Service Pack 1 and Service Pack 2

Discovery Timeline

2026-09-08 - CVE-2026-75736 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75736

Vulnerability Analysis

The flaw is a stored (persistent) Cross-Site Scripting weakness classified under [CWE-79]: Improper Neutralization of Input During Web Page Generation. AEM fails to properly sanitize or encode user-supplied input written into form field attributes or values. The malicious payload is stored server-side within the AEM repository. When any user renders the affected page, the browser interprets the injected content as executable JavaScript.

Exploitation requires an authenticated session with low privileges, such as a content author role. Because user interaction is required and the attack scope changes, the injected script can access resources beyond the vulnerable component, including the authenticated victim's cookies, CSRF tokens, and DOM data belonging to the AEM authoring interface.

Root Cause

The root cause is missing or insufficient output encoding when AEM renders form field values back to authenticated users. Form input containing HTML control characters or JavaScript event handlers is stored verbatim and later emitted into the page context without contextual escaping.

Attack Vector

The attack vector is network-based over standard HTTP or HTTPS to the AEM author or publish tier. An attacker with author-level access submits crafted input containing JavaScript into a vulnerable form field. When another authenticated user (typically a reviewer or administrator) opens the affected page, the payload executes with that user's privileges within the AEM session. This can be chained to escalate privileges by hijacking administrator sessions or performing forced actions via CSRF-like flows.

No verified public proof-of-concept code is available for this issue at the time of publication. Refer to the Adobe Security Update APSB26-98 for vendor-specific technical guidance.

Detection Methods for CVE-2026-75736

Indicators of Compromise

Form field values in the AEM JCR repository containing <script>, javascript:, or DOM event handler attributes such as onerror=, onload=, or onmouseover=.
Unexpected outbound HTTP requests from author or reviewer browsers to attacker-controlled domains shortly after loading AEM authoring pages.
Anomalous session token reuse or administrator actions originating from IP addresses associated with lower-privileged author accounts.

Detection Strategies

Review AEM access.log and dispatcher logs for POST requests to form component endpoints containing encoded script tags or JavaScript URI schemes.
Query the JCR repository for stored properties containing HTML or JavaScript tokens on form-related node types.
Deploy Content Security Policy (CSP) reporting to capture violations that would indicate injected inline script execution in the authoring UI.

Monitoring Recommendations

Enable audit logging for content author role modifications to form components and correlate with subsequent administrator page loads.
Monitor browser telemetry from privileged AEM users for script execution originating from unexpected DOM sources.
Alert on privilege changes, user creations, or replication actions performed within short intervals after an author edits a form component.

How to Mitigate CVE-2026-75736

Immediate Actions Required

Apply the AEM security updates referenced in Adobe bulletin APSB26-98 to all AEM Cloud Service environments and AEM 6.5 LTS deployments through Service Pack 2.
Audit existing form components and stored form field content for injected HTML or JavaScript before and after patching.
Restrict content author permissions to the minimum required and enforce reviewer workflows for any form component changes.

Patch Information

Adobe has released fixed builds for AEM Cloud Service and AEM 6.5 LTS. Consult the Adobe Security Update APSB26-98 for exact version numbers, service pack levels, and installation procedures for each affected release channel.

Workarounds

Enforce a strict Content Security Policy on AEM author and publish instances to block inline script execution and untrusted script sources.
Configure the AEM dispatcher to filter request parameters containing HTML tags or JavaScript event attributes destined for form submission endpoints.
Temporarily revoke form authoring permissions from non-essential author accounts until patches are applied and content is validated.

bash

# Configuration example
# Refer to Adobe APSB26-98 for authoritative remediation steps.
# See: https://helpx.adobe.com/security/products/experience-manager/apsb26-98.html