CVE-2026-79905: Adobe Experience Manager XSS Vulnerability

CVE-2026-79905 Overview

Adobe Experience Manager (AEM) contains a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] that allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields. The injected script executes in a victim's browser when they load the page containing the compromised field. The vulnerability carries a changed scope, meaning the impact extends beyond the vulnerable component.

Exploitation requires low privileges and user interaction. The flaw affects Adobe Experience Manager Cloud Service and AEM 6.5 LTS releases through Service Pack 2. Adobe published a fix in security advisory APSB26-98.

Critical Impact
Authenticated attackers can inject persistent JavaScript that runs in the browsers of authors, administrators, or site visitors, enabling session theft, credential harvesting, and unauthorized actions in the AEM administrative context.

Affected Products

Adobe Experience Manager Cloud Service (AEM as a Cloud Service)
Adobe Experience Manager 6.5 LTS (base, SP1, SP2)
Adobe Experience Manager on-premises versions listed in APSB26-98

Discovery Timeline

2026-09-08 - CVE-2026-79905 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-79905

Vulnerability Analysis

The vulnerability is a stored XSS flaw in form field handling within Adobe Experience Manager. An authenticated user with low privileges, such as a content author, can submit input containing JavaScript payloads that AEM stores without adequate output encoding. When another user, including higher-privileged administrators, later loads the page rendering that stored field, the browser executes the attacker-supplied script in the AEM origin's security context.

The changed CVSS scope indicates the vulnerability affects resources beyond the initially compromised component. In practice, this means script execution in an administrator's session can pivot to actions across the AEM instance, including content modification, workflow manipulation, or exfiltration of session tokens.

Exploitation requires user interaction because the victim must browse to the page containing the malicious content. Both confidentiality and integrity face limited impact; availability is not affected.

Root Cause

The root cause is improper neutralization of user-controlled input during web page generation [CWE-79]. AEM stores attacker-supplied form field values and later reflects them into rendered HTML without sufficient contextual output encoding or input sanitization, allowing script tags and event handlers to survive the render path.

Attack Vector

The attack vector is network-based over standard HTTPS access to the AEM authoring or delivery environment. An attacker authenticates with low-privilege credentials, submits a payload into a vulnerable form field, and waits for a victim to render the affected page. No elevated privileges are required to plant the payload.

No verified proof-of-concept code is publicly available. Refer to the Adobe Security Advisory APSB26-98 for vendor-supplied technical details.

Detection Methods for CVE-2026-79905

Indicators of Compromise

Form field values in the AEM Java Content Repository (JCR) containing <script>, javascript:, onerror=, onload=, or onclick= payloads
Unexpected outbound HTTP requests from author or publish instances to unfamiliar domains that could indicate script-driven data exfiltration
Content modifications performed under an administrator account with no corresponding legitimate user activity in access logs

Detection Strategies

Query the JCR for stored properties containing HTML tags or JavaScript event handlers in fields that should hold plain text
Review AEM request logs for POST requests to form submission endpoints from low-privileged accounts that contain encoded script markers
Correlate content author submissions with subsequent administrator page views to identify potential victim exposure windows

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to detect blocked inline script execution attempts on AEM-rendered pages
Monitor authentication logs for anomalous session activity, particularly session token reuse from unexpected IP addresses following administrator page loads
Alert on any modification to AEM security configurations, user permissions, or workflow definitions outside change windows

How to Mitigate CVE-2026-79905

Immediate Actions Required

Apply the patches listed in Adobe security advisory APSB26-98 to all AEM Cloud Service and AEM 6.5 LTS deployments
Audit accounts with content authoring privileges and remove access for users who no longer require it
Review the JCR for existing stored payloads that may have been planted prior to patching

Patch Information

Adobe released fixed builds referenced in the Adobe Security Advisory APSB26-98. AEM as a Cloud Service customers receive the fix through the standard cloud release cadence. On-premises AEM 6.5 LTS operators must install the corresponding Service Pack or hotfix identified in the advisory.

Workarounds

Enforce a strict Content Security Policy that disallows inline script execution on AEM-rendered pages
Restrict low-privileged authoring accounts from editing components that render user input into HTML contexts
Enable AEM's built-in XSS protection APIs (XSSAPI) in custom components to enforce contextual output encoding

bash

# Example Content Security Policy header to restrict inline script execution
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'