CVE-2026-75742: Adobe Experience Manager XSS Vulnerability

CVE-2026-75742 Overview

Adobe Experience Manager (AEM) contains a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in form field handling. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in the browser of any user who visits the page containing the compromised field. The scope is changed, meaning code runs in a security context beyond the vulnerable component.

The issue affects Adobe Experience Manager Cloud Service and AEM 6.5 LTS releases through SP2. Exploitation requires user interaction and low-level authentication, limiting mass exploitation but enabling session theft, credential harvesting, and administrative account takeover through targeted delivery.

Critical Impact
Authenticated attackers can persist JavaScript in AEM forms to hijack sessions of administrators or content authors viewing the affected pages.

Affected Products

Adobe Experience Manager Cloud Service (AEM as a Cloud Service)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS SP1 and SP2

Discovery Timeline

2026-09-08 - CVE-2026-75742 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75742

Vulnerability Analysis

The vulnerability is a stored XSS flaw in Adobe Experience Manager form components. AEM fails to properly sanitize or encode user-supplied input written into form field attributes or values. An attacker with low privileges, such as a content contributor role, submits input containing HTML or JavaScript that AEM persists to the underlying JCR repository.

When a subsequent visitor renders the affected page, the stored payload executes in their browser session. Because the CVSS scope is changed, the injected script can affect resources outside the component that stored it, including authenticated AEM author sessions and cross-origin content served under the same rendering context.

Successful exploitation enables session token theft, forced administrative actions through the AEM author interface, defacement of published content, and pivoting to internal AEM APIs accessible from the victim's browser.

Root Cause

The root cause is insufficient output encoding of form field content before rendering it into HTML responses. AEM does not apply context-aware escaping for attribute or script contexts when the form field is emitted, allowing attacker-controlled input to break out of its intended data context.

Attack Vector

The attacker authenticates to AEM with a low-privileged account that can edit form content. They submit a payload containing script tags or event handlers into a vulnerable form field. The payload is stored in the repository and served to any user who requests the containing page. User interaction, such as browsing to the page, is required for execution.

Refer to the Adobe Security Advisory APSB26-98 for technical details specific to the vulnerable component.

Detection Methods for CVE-2026-75742

Indicators of Compromise

Form field values in the JCR repository containing <script> tags, javascript: URIs, or DOM event handlers such as onerror, onload, or onmouseover.
Unexpected outbound requests from author or publish instances to attacker-controlled domains when rendering form pages.
AEM audit log entries showing form component edits by low-privileged users followed by content activation.

Detection Strategies

Query the JCR repository for form field properties containing HTML control characters or script keywords using JCR-SQL2 or Query Builder.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from AEM-rendered forms.
Review web server and CDN logs for anomalous requests to form-hosting pages followed by requests to external domains from the same client sessions.

Monitoring Recommendations

Monitor AEM Sling audit logs for POST requests to form component paths from accounts with limited authoring roles.
Alert on Dispatcher and CDN traffic patterns showing script execution redirected to non-Adobe domains from author or publish instances.
Track browser reports from CSP endpoints for violations tied to AEM-hosted pages containing forms.

How to Mitigate CVE-2026-75742

Immediate Actions Required

Apply the fixes described in Adobe Security Advisory APSB26-98 to AEM Cloud Service and AEM 6.5 LTS instances.
Audit all form components authored since the vulnerability's public disclosure for injected script payloads and remove any malicious content.
Review and restrict authoring permissions so that only trusted users can create or edit form fields.

Patch Information

Adobe has released updates for Adobe Experience Manager Cloud Service and Adobe Experience Manager 6.5 LTS SP2 addressing this stored XSS. Consult Adobe Security Advisory APSB26-98 for exact build numbers and update procedures for both Cloud Service and on-premises LTS deployments.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts on pages containing AEM forms, reducing the impact of injected payloads.
Configure the AEM Dispatcher to filter form submission parameters against an allowlist of expected characters and reject HTML control characters.
Temporarily revoke authoring rights on affected form components for non-essential users until patching is complete.

bash

# Example Dispatcher filter rule to block script tags in form submissions
/0100 { /type "deny" /url "*<script*" }
/0101 { /type "deny" /url "*javascript:*" }
/0102 { /type "deny" /url "*onerror=*" }