CVE-2026-75741: Adobe Experience Manager XSS Vulnerability

CVE-2026-75741 Overview

Adobe Experience Manager (AEM) contains a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] that allows a low-privileged attacker to inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they navigate to the page containing the injected content. Adobe published the issue in security advisory APSB26-98, and the scope is changed, meaning the injected script can affect resources beyond the vulnerable component.

The flaw affects both on-premises AEM 6.5 LTS deployments and the AEM Cloud Service. Exploitation requires authentication and user interaction, which limits mass exploitation but does not eliminate risk in multi-tenant authoring environments.

Critical Impact
An authenticated low-privileged attacker can persist malicious JavaScript in form fields, executing arbitrary script in the browsers of authors, administrators, or site visitors who render the affected page.

Affected Products

Adobe Experience Manager Cloud Service (AEM CS)
Adobe Experience Manager 6.5 LTS (base, SP1, SP2)
Adobe Experience Manager on-premises versions covered by advisory APSB26-98

Discovery Timeline

2026-09-08 - CVE-2026-75741 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75741

Vulnerability Analysis

The vulnerability is a stored XSS flaw in AEM form components. AEM fails to sanitize or encode user-controlled input before persisting it and rendering it back to other users. When a victim loads a page that contains the stored payload, the AEM renderer emits the attacker's JavaScript into the response Document Object Model (DOM), where the browser executes it in the origin of the AEM site.

The changed scope means the vulnerable component and the impacted component are managed by different security authorities. In practice, script injected through an authoring surface can execute against content served to end users or against elevated author sessions in the AEM console.

Because authentication is required, this vulnerability is most dangerous in environments where content authors, marketers, or contractors have write access to forms but are not fully trusted. Successful exploitation can lead to session theft, unauthorized content publication, or targeted attacks against AEM administrators.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Adobe Experience Manager stores untrusted input from form field configuration and reflects it into rendered HTML without applying context-appropriate output encoding.

Attack Vector

An attacker authenticates to AEM with low privileges, typically a content author role. The attacker edits a vulnerable form field and injects a JavaScript payload into an attribute or body that will later be rendered without encoding. When another user, such as a reviewer, administrator, or site visitor, opens the page containing the affected field, the browser executes the stored script in the AEM origin. See the Adobe Security Advisory APSB26-98 for technical scope.

Detection Methods for CVE-2026-75741

Indicators of Compromise

Form component definitions or JCR nodes containing <script>, javascript:, onerror=, or onload= substrings in fields that should hold plain text.
Outbound requests from author or publish instances to unfamiliar domains shortly after a page render, indicating script-driven exfiltration.
Unexpected modifications to AEM form components performed by low-privileged author accounts.

Detection Strategies

Query the JCR repository for stored HTML or script fragments inside properties belonging to form components.
Review AEM audit logs for form field edits by accounts that do not normally modify component structure.
Inspect Dispatcher and CDN access logs for anomalous referers or query strings tied to page URLs containing forms.

Monitoring Recommendations

Alert on new or modified JCR properties whose values match XSS payload patterns.
Monitor author-role sessions for spikes in DOM-based navigation, cookie access, or credential prompts.
Correlate AEM authentication events with subsequent content changes to identify compromised author accounts.

How to Mitigate CVE-2026-75741

Immediate Actions Required

Apply the updates listed in Adobe Security Advisory APSB26-98 to AEM 6.5 LTS and confirm AEM Cloud Service instances are on the patched release.
Audit all content author and forms author accounts, removing any that are inactive or over-privileged.
Search the JCR for existing payloads in form field properties and remove any malicious content before patching.

Patch Information

Adobe released fixed versions for AEM Cloud Service and AEM 6.5 LTS (including SP1 and SP2) as part of the September 2026 security update tracked in APSB26-98. Cloud Service customers receive the fix through the standard Adobe release channel. On-premises customers must apply the corresponding LTS service pack or cumulative fix pack referenced in the advisory.

Workarounds

Restrict form editing permissions to a minimal set of trusted authors through AEM ACLs.
Enforce a strict Content Security Policy (CSP) at the Dispatcher or CDN layer to block inline script execution on rendered pages.
Enable the AEM XSS Protection API and confirm custom form components call XSSAPI.encodeForHTML or XSSAPI.encodeForHTMLAttr on all user-controlled values.

bash

# Example Dispatcher/CDN response header enforcing CSP against inline script
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"