# CVE-2026-75744

Stored XSS in Adobe Experience Manager Forms (JEE) enabling script injection.

- Page: https://www.vulneraibility.com/cve/CVE-2026-75744
- CVSS: 8.1
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 1.18% (percentile 67.8)
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-09-22)
- Weakness: CWE-79
- Published: 2026-09-22

## Affected versions

- Adobe AEM 6.5 Forms JEE: affected <= 6.5.25; fixed in 6.5.25 (AEMForms-6.5.0-0134 Hotfix)
- Adobe AEM 6.5 LTS Forms JEE: affected <= 6.5 LTS SP2; fixed in 6.5 LTS SP3

A version outside these ranges is not a statement that it is unaffected.

## Impact

Stored XSS lets attackers inject JavaScript that executes in victims' browsers to hijack sessions, perform actions as users, steal credentials, or escalate access.

## Action

Immediate action required

## Recommendation

Apply Adobe's AEM Forms security update immediately.

## References

- [advisory] https://helpx.adobe.com/security/products/aem-forms/apsb26-151.html

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.