CVE-2026-75740: Adobe Experience Manager XSS Vulnerability

CVE-2026-75740 Overview

Adobe Experience Manager (AEM) contains a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting form field input handling. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they view the page containing the affected field. The vulnerability carries a changed scope, meaning the impact extends beyond the vulnerable component.

The issue affects Adobe Experience Manager Cloud Service and AEM 6.5 LTS through Service Pack 2. Adobe published security bulletin APSB26-98 describing the flaw and remediation.

Critical Impact

Authenticated attackers can execute arbitrary JavaScript in other users' browser sessions, enabling session hijacking, credential theft, and unauthorized actions within the AEM application context.

Affected Products

• Adobe Experience Manager Cloud Service (AEM as a Cloud Service)
• Adobe Experience Manager 6.5 LTS (base release)
• Adobe Experience Manager 6.5 LTS Service Pack 1 and Service Pack 2

Discovery Timeline

• 2026-09-08 - CVE-2026-75740 published to the National Vulnerability Database
• 2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75740

Vulnerability Analysis

The vulnerability resides in AEM form field processing, where user-supplied input is stored and later rendered without sufficient output encoding. When a victim navigates to a page containing the tainted field, the browser parses the injected markup and executes attacker-controlled JavaScript in the origin of the AEM application.

Exploitation requires an authenticated session with low privileges and user interaction from the victim. The changed scope indicates that the impact reaches components beyond the vulnerable one, such as adjacent AEM authoring or publish surfaces that render the stored content.

Stored XSS in a content management platform like AEM is particularly consequential because injected payloads can persist across authoring workflows and reach administrators, editors, and end-users of published sites.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. AEM stores attacker-supplied field content and reflects it into rendered HTML without contextual output encoding. The rendering layer treats the stored value as trusted markup rather than user data requiring escaping.

Attack Vector

The attack requires network access to the AEM instance and valid low-privileged credentials. The attacker submits a form containing a JavaScript payload embedded in an affected field. The payload persists in AEM storage. When any authenticated user, including higher-privileged administrators, loads the page rendering that field, the script executes in their browser session.

No verified public proof-of-concept code exists for this vulnerability. Refer to the Adobe Security Advisory APSB26-98 for vendor-supplied technical context.

Detection Methods for CVE-2026-75740

Indicators of Compromise

• Form field values in AEM repositories containing <script> tags, javascript: URIs, or HTML event handlers such as onerror=, onload=, or onclick=.
• Unexpected outbound HTTP requests from authenticated user browsers to attacker-controlled domains shortly after loading AEM pages.
• Session token or cookie exfiltration patterns in web proxy logs originating from AEM authoring or publish sessions.

Detection Strategies

• Audit AEM JCR content repositories for stored HTML markup or JavaScript within form component properties.
• Deploy a Content Security Policy (CSP) in report-only mode to surface script execution from unexpected inline sources or origins.
• Correlate AEM access logs with web application firewall (WAF) alerts flagging XSS payload patterns in POST requests to form endpoints.

Monitoring Recommendations

• Enable verbose AEM audit logging for form submission and content modification events by low-privileged users.
• Monitor for anomalous session activity such as concurrent logins, unusual page access sequences, or privilege changes on administrator accounts.
• Track browser-side JavaScript errors and CSP violation reports from users interacting with AEM-authored pages.

How to Mitigate CVE-2026-75740

Immediate Actions Required

• Apply the security update referenced in Adobe bulletin APSB26-98 to all AEM Cloud Service and AEM 6.5 LTS deployments.
• Review authenticated user accounts and remove unnecessary form authoring privileges from low-trust users.
• Scan existing AEM content repositories for previously injected payloads and sanitize affected form field values.

Patch Information

Adobe released fixes for AEM Cloud Service and AEM 6.5 LTS (including Service Pack 1 and Service Pack 2). Full remediation details are available in the Adobe Security Advisory APSB26-98. Administrators should validate patch application against the versions listed in the advisory.

Workarounds

• Enforce a strict Content Security Policy limiting inline scripts and restricting script sources to trusted origins.
• Deploy a WAF rule set that inspects and blocks XSS payload patterns in requests to AEM form endpoints.
• Restrict form authoring permissions to a minimal set of vetted users until patches are applied across all environments.

# Example CSP header to reduce stored XSS impact on AEM-rendered pages
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'