CVE-2026-75737: Adobe Experience Manager XSS Vulnerability

CVE-2026-75737 Overview

CVE-2026-75737 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM). A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in the browser of any victim who visits the page containing the tainted field. The flaw carries a changed scope, meaning the injected script can affect resources beyond the vulnerable component. Adobe published this issue in security advisory APSB26-98, covering AEM Cloud Service and AEM 6.5 LTS releases up to Service Pack 2.

Critical Impact
Authenticated attackers with low privileges can execute arbitrary JavaScript in victims' browsers, enabling session theft, credential capture, and unauthorized actions within the AEM authoring or delivery context.

Affected Products

Adobe Experience Manager Cloud Service (AEM CS)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS Service Pack 1 and Service Pack 2

Discovery Timeline

2026-09-08 - CVE-2026-75737 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75737

Vulnerability Analysis

CVE-2026-75737 is a stored XSS flaw categorized under CWE-79: Improper Neutralization of Input During Web Page Generation. AEM stores attacker-supplied input in form field content without adequate output encoding. When another user renders a page containing the persisted payload, the browser parses the injected markup and executes attacker-controlled JavaScript.

Exploitation requires authentication with low privileges and user interaction from a victim who must load the affected page. The changed scope indicates the injected script can reach browser contexts or resources outside the immediate vulnerable component, such as the AEM author instance UI or shared session data. Confidentiality and integrity impacts are limited, and there is no direct availability impact.

Root Cause

The root cause is missing or insufficient contextual output encoding when AEM renders user-controlled form field values into HTML responses. AEM should apply HTL/Sightly-based escaping or the XSS API for the executing HTML context, but the vulnerable code path emits stored input directly into the DOM. Persistence in the JCR repository turns each visit to the affected page into a script execution event.

Attack Vector

The attack vector is network-based and requires an authenticated session with author or contributor-level rights on the AEM instance. The attacker submits a crafted payload, such as an <img> tag with an onerror handler or an inline <script> element, into a form field that is not properly sanitized. The payload is written to the repository and served to every subsequent visitor of the containing page. Because scope is changed, the script executes with the privileges of the viewer's session, which can include administrative users in the author environment.

No verified public proof-of-concept exists at time of publication. Refer to the Adobe Security Advisory APSB26-98 for vendor-supplied technical detail.

Detection Methods for CVE-2026-75737

Indicators of Compromise

Form field values in JCR nodes containing HTML tags such as <script>, <svg>, <iframe>, or event handler attributes like onerror, onload, or onmouseover.
Unexpected outbound requests from author or publish instances to attacker-controlled domains referenced in stored payloads.
AEM access logs showing repeated POST requests to form submission endpoints from a single low-privileged account.

Detection Strategies

Query the JCR repository for persisted properties containing script tags, JavaScript URI schemes (javascript:), or HTML event attributes.
Deploy Content Security Policy (CSP) headers in report-only mode to surface script execution from unexpected origins on AEM-rendered pages.
Inspect web application firewall logs for HTTP request bodies containing common XSS payload patterns targeting /content/forms or Sling form handlers.

Monitoring Recommendations

Alert on authenticated sessions that modify form component properties outside of normal authoring workflows or business hours.
Baseline the set of accounts permitted to edit form components and generate alerts on privilege changes to those accounts.
Monitor browser telemetry from endpoints accessing AEM author instances for anomalous script execution or credential input on non-login pages.

How to Mitigate CVE-2026-75737

Immediate Actions Required

Apply the fixes referenced in Adobe Security Advisory APSB26-98 to AEM Cloud Service and AEM 6.5 LTS instances.
Audit all accounts with form-editing permissions and revoke access that is not required for current job functions.
Review recently modified form components for injected HTML or JavaScript and remove or quarantine any tainted content.

Patch Information

Adobe addressed CVE-2026-75737 in the AEM releases documented in advisory APSB26-98. AEM Cloud Service customers receive the fix through the standard managed release cadence. AEM 6.5 LTS operators must upgrade to the Service Pack or hotfix identified in the advisory. Verify the deployed version after patching and re-test affected form components.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins on AEM-rendered pages.
Configure a web application firewall rule to block HTML tags and event handlers in form submission parameters until patching is complete.
Temporarily restrict form editing permissions to a minimal, trusted group of authors while validating and remediating stored content.

bash

# Example: sample WAF rule (ModSecurity syntax) to block common XSS payloads in form parameters
SecRule ARGS "@rx (?i)(<script|onerror\s*=|onload\s*=|javascript:)" \
  "id:1075737,phase:2,deny,status:403,log,msg:'Potential XSS payload targeting AEM form field (CVE-2026-75737)'"