CVE-2026-75738: Adobe Experience Manager XSS Vulnerability

CVE-2026-75738 Overview

Adobe Experience Manager (AEM) contains a stored Cross-Site Scripting (XSS) vulnerability affecting form field processing. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they navigate to the page containing the affected field. The vulnerability carries a changed scope, meaning the impact extends beyond the vulnerable component to other browser contexts. This flaw affects both AEM Cloud Service and AEM 6.5 LTS releases (including Service Pack 1 and Service Pack 2). Adobe published Security Advisory APSB26-98 addressing the issue.

Critical Impact
A low-privileged attacker can persist malicious JavaScript inside AEM form fields, enabling session theft, credential harvesting, or unauthorized actions against any user who views the affected page.

Affected Products

Adobe Experience Manager (AEM Cloud Service)
Adobe Experience Manager 6.5 LTS (base, SP1, SP2)
Adobe Experience Manager on-premises current release

Discovery Timeline

2026-09-08 - CVE-2026-75738 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75738

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw classified under [CWE-79], Improper Neutralization of Input During Web Page Generation. AEM fails to sanitize or encode user-supplied content submitted through specific form fields. The attacker-controlled input is persisted server-side and later rendered in the browser without adequate output encoding.

The scope change means a payload delivered through the vulnerable component can affect resources managed under a different security authority. In AEM deployments, this commonly translates to author consoles, published pages, or administrative previews executing the injected script within a different origin's trust boundary.

Exploitation requires authentication with low privileges and user interaction from the victim. Successful exploitation compromises the confidentiality and integrity of the victim's session but does not directly impact availability.

Root Cause

The root cause is missing or insufficient input sanitization and output encoding for content rendered from form field values. AEM stores the raw payload and reflects it into the DOM without contextual escaping, allowing arbitrary HTML and JavaScript to execute when the page is rendered.

Attack Vector

The attack requires network access to the AEM instance and a valid low-privileged account, such as a content contributor role. The attacker submits a crafted payload into a vulnerable form field. When an authenticated user or administrator later loads the page containing that field, the injected script executes with the victim's browser privileges.

Typical post-exploitation activity includes stealing session cookies, forging requests against the AEM author interface, exfiltrating draft content, or pivoting to higher-privileged accounts via forced actions. Refer to the Adobe Security Advisory APSB26-98 for vendor technical details.

Detection Methods for CVE-2026-75738

Indicators of Compromise

Form field values containing <script>, javascript:, event handlers such as onerror= or onload=, or encoded variants like <script>.
Unexpected outbound HTTP requests from AEM author or publish sessions to attacker-controlled domains.
New or modified content nodes in the JCR repository authored by low-privileged accounts touching restricted paths.
Anomalous session token reuse from geographically distinct IP addresses following author page views.

Detection Strategies

Review AEM request.log and access.log for POST requests to form endpoints containing suspicious script markup.
Audit JCR content changes for stored properties containing HTML or JavaScript control characters.
Deploy Content Security Policy (CSP) violation reporting to surface inline script execution attempts.
Correlate authoring activity with subsequent administrator page loads to identify potential victim exposure windows.

Monitoring Recommendations

Enable verbose audit logging on the AEM author instance and forward events to a centralized SIEM.
Alert on modifications to form components made by contributor-tier accounts.
Monitor administrator sessions for unusual XHR or Fetch activity originating from rendered content.
Track failed CSP directives to detect attempted script injection even when the payload is blocked.

How to Mitigate CVE-2026-75738

Immediate Actions Required

Apply the security update published in Adobe Security Advisory APSB26-98 to all AEM Cloud Service, AEM 6.5, SP1, and SP2 environments.
Audit all low-privileged AEM accounts and disable inactive contributor credentials.
Review stored form field content for existing malicious payloads and remove them from the JCR repository.
Rotate session tokens and administrative credentials that may have been exposed via prior form page views.

Patch Information

Adobe released fixed builds for Adobe Experience Manager Cloud Service and Adobe Experience Manager 6.5 LTS. Consult Adobe Security Advisory APSB26-98 for exact version numbers and installation guidance. AEM Cloud Service customers receive the fix through the standard cloud update channel, while on-premises operators must download and apply the corresponding service pack or hotfix.

Workarounds

Restrict form authoring permissions to trusted, vetted user groups until the patch is deployed.
Deploy a Web Application Firewall (WAF) rule to block payloads containing script tags or JavaScript event handlers on form submission endpoints.
Enforce a strict Content Security Policy that disallows inline scripts and unsafe evaluation on AEM-rendered pages.
Increase review requirements for content workflows involving form components pending remediation.

bash

# Example strict Content-Security-Policy header applied at the AEM dispatcher
# Add to dispatcher vhost configuration
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"