CVE-2026-75729: Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Published Sep 8, 2026
·Updated
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Affected Software
1 affected component
Adobe Adobe Experience Manager
Event History
Sep 8, 2026
CVE Published
via MITRE·07:56 PM
Data Sourced
via MITRE·07:56 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs low-privileged access to Adobe Experience Manager and must be able to submit content to a vulnerable form field. Exploitation also requires a victim to browse to the page containing the injected content.
2
What is the likely impact on a victim?
Malicious JavaScript can execute in the victim's browser. The reported impact includes limited confidentiality and integrity effects, and the vulnerability has changed scope.