CVE-2026-75744

Executive Summary

CVE-2026-75744 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) Forms JEE. A high-privileged attacker can inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who views the affected page. Successful exploitation can result in elevated access, session hijacking, or full account compromise, with a CVSS score of 8.1 reflecting high confidentiality and integrity impact and a changed scope.

Technical Analysis

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS). In AEM Forms JEE, user-supplied input entered into form fields is not adequately sanitized or encoded before being stored and subsequently rendered back to other users. Because the payload is persisted server-side (stored XSS), the malicious script is served to every visitor of the affected form or page until the injected content is removed.

The CVSS vector AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N indicates:

• AV:N (Network) — the vulnerability is exploitable remotely over the network.
• AC:L (Low) — no specialized conditions are required to exploit it.
• PR:H (High) — the attacker must possess high privileges (e.g., a form-authoring or administrative account) to inject the payload.
• UI:R (Required) — exploitation requires a victim to interact with (browse to) the page containing the vulnerable field.
• S:C (Changed) — the impact scope extends beyond the vulnerable component, meaning the injected script can affect resources outside the original security context (e.g., the victim's broader AEM session or connected applications).
• C:H / I:H — high confidentiality and integrity impact.
• A:N — no direct availability impact.

The attack surface is the AEM Forms JEE form-authoring and rendering pipeline. The stored nature of the payload means no attacker-supplied link is strictly necessary; any user navigating to the compromised form triggers execution. The "Scope: Changed" rating is significant: it implies the injected JavaScript may be able to reach resources or permissions not bounded by the original vulnerable component, magnifying the post-exploitation risk beyond a single form view.

No public proof-of-concept, Nuclei template, or exploit code is currently available, and no specific code paths, class names, or endpoint parameters are disclosed in the provided intelligence. The analysis therefore remains at the vulnerability-class level.

Exploitation Scenarios

The following chain is inferred from the vulnerability class and the NVD description; no public PoC exists and no implementation-specific details are available.

1. Reconnaissance / Target Identification. The attacker identifies an internet- or intranet-facing AEM Forms JEE instance hosting forms. Public form pages (/content/forms/... typical AEM paths) and authoring interfaces are enumerated. The attacker confirms they can obtain or already hold a high-privileged account (author, form author, or admin) capable of editing form field content.

2. Triggering the Flaw. Using the high-privileged account, the attacker creates or edits a form and injects a malicious script payload into a form field. Because the application fails to neutralize the input on storage and again on output (CWE-79), the payload is persisted. No coding or server compromise is required — the flaw is abuse of the normal authoring workflow combined with missing output encoding.

3. Payload / Execution. When any user (a lower-privileged employee, business partner, or administrator) browses to the page containing the vulnerable field, the stored script executes in that victim's browser session context. Execution occurs automatically upon page render — a classic stored XSS delivery with no click required beyond viewing the page.

4. Post-Exploitation Impact. Due to the "Scope: Changed" rating, the script can act across the victim's authenticated session and potentially the wider AEM domain. Realistic outcomes include session token theft and account takeover, action forgery on behalf of the victim, exfiltration of form data and content, further pivoting into connected services, and — where the victim holds elevated rights — escalation to administrative control of the AEM Forms environment.

Impact Assessment

Successful exploitation yields high confidentiality and integrity impact within a changed scope, as reflected in the CVSS subscores. The most likely consequences are:

• Session hijacking and account takeover of any user who views the poisoned form.
• Privilege escalation, especially where higher-privileged users (or admins) are lured to review the form.
• Data exfiltration of form submissions and sensitive business content managed by AEM Forms.
• Persistent compromise — because the payload is stored, remediation requires locating and removing the injected field content, not merely blocking an inbound request.

The blast radius is bounded by the population of users who access the affected form(s). In enterprise deployments where AEM Forms JEE hosts customer-facing or internal processes (onboarding, claims, HR, finance), the affected user base can be large and the business impact material. However, exploitation requires a pre-existing high-privileged account (PR:H) and victim interaction (UI:R), which tempers the overall likelihood relative to an unauthenticated flaw.

Detection Guidance

Sigma Rule

title: Potential Stored XSS Payload Injection in Adobe Experience Manager Forms JEE
id: 6f9c1a2e-7574-4c1e-9b3a-0c1d2e3f4a5b
status: experimental
description: Detects script-tag or event-handler patterns submitted to AEM Forms JEE form fields, indicative of stored XSS injection (CVE-2026-75744).
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: web
  product: aem
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
  selection_xss:
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - 'onmouseover='
      - '<img'
      - '<svg'
  condition: selection_method and selection_xss
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate rich-text form content that contains markup
  - Security scanners and penetration test traffic
level: medium
tags:
  - attack.t1059.007
  - cve.2026.75744

YARA Rule

rule CVE_2026_75744_AEM_Forms_Stored_XSS
{
    meta:
        description = "Detects stored XSS payload patterns in AEM Forms JEE request/log data related to CVE-2026-75744"
        author = "Threat Intelligence"
        date = "2026-01-01"
        cve = "CVE-2026-75744"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75744"

    strings:
        $s1 = "<script" nocase
        $s2 = "javascript:" nocase
        $s3 = "onerror=" nocase
        $s4 = "onload=" nocase
        $s5 = "onmouseover=" nocase
        $s6 = "document.cookie" nocase
        $s7 = "eval(" nocase
        $s8 = "aem-forms" nocase
        $s9 = "/content/forms/" nocase

    condition:
        uint16(0) == 0x0A0D or true
        and any of ($s1, $s2, $s3, $s4, $s5, $s6, $s7)
        and any of ($s8, $s9)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-75744 Possible Stored XSS Injection in Adobe Experience Manager Forms JEE"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/content/forms/"; http.request_body; content:"<script"; nocase; http.request_body; content:"</script>"; nocase; reference:cve,2026-75744; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-75744; classtype:web-application-attack; sid:202675744; rev:1;)

alert http any any -> any any (msg:"CVE-2026-75744 XSS Event Handler Payload to AEM Forms"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/content/forms/"; http.request_body; content:"onerror="; nocase; reference:cve,2026-75744; classtype:web-application-attack; sid:202675745; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where http.request.method in ("POST","PUT") and
     url.path like "/content/forms/*"]
  [network where http.request.method in ("POST","PUT") and
     url.path like "/content/forms/*" and
     http.request.body.content regex ".*(<script|javascript:|onerror=|onload=|onmouseover=).*"]

Splunk SPL Query

index=web (site="aem_forms" OR uri_path="/content/forms/*")
(http_method=POST OR http_method=PUT)
(form_data="*<script*" OR form_data="*onerror=*" OR form_data="*onload=*"
 OR form_data="*javascript:*" OR form_data="*onmouseover=*")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(form_data) as payload values(src_ip) as src_ips
        by user dest uri_path
| where count > 0
| sort - last_seen

Wazuh OSSEC Rule

<group name="web,aem,attack,">
  <rule id="100574" level="10">
    <if_sid>31100,31101,31103,31104,31106,31108,31151</if_sid>
    <match>POST</match>
    <url>/content/forms/</url>
    <regex>script|javascript:|onerror=|onload=|onmouseover=</regex>
    <description>CVE-2026-75744: Possible stored XSS injection against Adobe Experience Manager Forms JEE</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2026_75744,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations.

   • Apply strict input validation and output encoding in AEM Forms JEE form fields: HTML-encode all user-supplied content before storage and before rendering.
   • Enforce a Content Security Policy (CSP) that disallows inline script execution and restricts script sources.
   • Restrict and audit high-privileged AEM accounts; enforce least privilege and strong MFA.
   • Deploy a web application firewall (WAF) with XSS rules as a compensating control (detection, not a fix).
   • Review existing forms for any injected content; proactively search for <script>, event handlers, and javascript: patterns in stored form data.

2. Patch / Upgrade Steps.

   • No vendor patch is currently available per tracked sources. Monitor the Adobe Product Security Bulletin / APSB feed and the Adobe Experience Manager security advisories page continuously.
   • When a fixed version is released, upgrade AEM Forms JEE immediately and re-validate that output encoding fixes resolve stored payload rendering.
   • Re-scan all persisted form content after upgrade, since stored payloads survive patching until removed.

3. Long-Term Hardening.

   • Implement secure coding standards and centralized output encoding across all form-rendering pipelines.
   • Adopt a formal input-validation and sanitization library rather than ad-hoc filtering.
   • Add automated DAST/SAST scanning to the AEM development and deployment lifecycle.
   • Log, monitor, and alert on all privileged form-editing activity to detect malicious field injection early.

References

• NVD — CVE-2026-75744: https://nvd.nist.gov/vuln/detail/CVE-2026-75744
• MITRE CWE-79 (Improper Neutralization of Input During Web Page Generation / XSS): https://cwe.mitre.org/data/definitions/79.html
• Adobe Product Security Bulletins and Advisories: https://helpx.adobe.com/security.html
• OWASP Cross Site Scripting Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
• CISA Known Exploited Vulnerabilities Catalog (current status: not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE in the provided data. No public exploit or proof-of-concept is available.