CVE-2026-75731 PUBLISHED

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Assigner: adobe
Reserved: 18.08.2026 Published: 08.09.2026 Updated: 08.09.2026

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS Score: 5.4

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	Low	Integrity Impact	Low
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Adobe
Product	Adobe Experience Manager as a Cloud Service
Versions	Default: unaffected affected from 0 to 2026.7.0 (incl.) Version 2026.8.0 is unaffected

Vendor	Adobe
Product	Adobe Experience Manager 6.5 LTS
Versions	Default: unaffected affected from 0 to SP2 (incl.) Version SP3 is unaffected

Vendor	Adobe
Product	Adobe Experience Manager 6.5
Versions	Default: unaffected affected from 0 to 6.5.24 (incl.) Version 6.5.25 is unaffected

References

https://helpx.adobe.com/security/products/experience-manager/apsb26-98.html

Problem Types

Cross-site Scripting (Stored XSS) (CWE-79) CWE