CVE-2026-75744: Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The issue requires a high-privileged attacker. That attacker must be able to inject malicious script content into vulnerable form fields.
Does exploitation require a victim to take any action?
Yes. The malicious JavaScript executes when a victim browses to a page containing the vulnerable field.
What is the expected impact if exploitation succeeds?
The vulnerability can expose or compromise the victim’s account or session, with high confidentiality and integrity impact. The reported impact does not include availability loss, and the vulnerability crosses a security scope boundary.