CVE-2026-75737 in Experience Manager as a Cloud Service
Summary
by MITRE • 09/09/2026
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
Adobe Experience Manager contains a stored Cross-Site Scripting vulnerability within its form handling components, specifically affecting how user-supplied input is processed and rendered back to users without adequate sanitization or encoding. This flaw allows an attacker with low-privileged access to inject malicious JavaScript code into vulnerable form fields on the server side. Unlike reflected XSS where the payload is delivered via a link, stored XSS persists in the application's database or storage mechanism, meaning the malicious script remains active until it is manually removed by an administrator or expires based on data retention policies. This persistence significantly increases the attack surface and potential impact because every user who views the affected page will trigger the execution of the injected code within their own browser context.
The technical nature of this vulnerability stems from insufficient validation of input data before storage and a failure to properly encode output when rendering that data back into HTML documents. When an attacker submits a form containing script tags or event handlers such as onload or onerror, the application accepts these inputs without stripping out dangerous characters or escaping them appropriately. Consequently, when another user navigates to the page displaying this content, their browser interprets the stored payload as executable code rather than plain text. This execution occurs within the security context of the Adobe Experience Manager domain, granting the malicious script access to cookies, session tokens, and other sensitive information associated with that domain.
The operational impact of exploiting this vulnerability is severe due to its potential for widespread compromise. An attacker can use the executed JavaScript to steal user sessions by exfiltrating authentication cookies to a remote server controlled by the adversary. This enables account takeover attacks where the attacker assumes the identity of legitimate users, potentially gaining access to restricted areas of the application or performing actions on behalf of those users. Furthermore, the script could be used to deface web pages, redirect victims to phishing sites designed to harvest credentials, or deploy further malware onto victim systems through drive-by downloads if browser vulnerabilities are present. The scope change noted in reports indicates that this vulnerability may affect a broader range of components than previously understood, increasing the likelihood of successful exploitation across different modules within the platform.
From a classification perspective, this issue aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and specifically falls under Stored XSS variants where data is persisted before being served to users. In terms of adversary tactics, this vulnerability facilitates techniques associated with ATT&CK ID T1059 Command and Control scripting or potentially T1204 User Execution if the payload tricks a user into clicking something that triggers additional malicious behavior after initial script execution. The ability for low-privileged attackers to execute arbitrary code highlights significant gaps in input validation frameworks within the application logic, allowing privilege escalation through social engineering rather than direct system exploitation.
Mitigation strategies should focus on implementing robust defense-in-depth measures immediately while patches are developed or applied by Adobe. Developers must enforce strict output encoding using context-aware techniques such as HTML entity encoding for data inserted into HTML bodies and JavaScript string escaping for dynamic script generation. Input validation should be implemented at multiple layers, including client-side checks for usability and server-side validations to ensure only expected character sets and formats are accepted. Additionally, deploying a Web Application Firewall can provide an additional layer of protection by filtering out requests containing known XSS patterns before they reach the application logic. Enabling Content Security Policy headers with strict directives regarding script sources helps mitigate damage even if injection occurs by preventing unauthorized scripts from executing in the victim's browser environment. Regular security audits and penetration testing focused on form handling mechanisms are essential to identify similar flaws across other parts of the system.