Adobe Experience Manager: 25 XSS and Input Validation Flaws Disclosed Together
Adobe Experience Manager hit by 25 vulnerabilities on Sept 8, 2026, including stored and DOM-based XSS flaws.
Key findings
- Adobe Experience Manager: 25 CVEs disclosed on Sept 8, 2026, primarily XSS vulnerabilities.
- Batch includes stored XSS, DOM-based XSS, and an improper input validation flaw.
- All vulnerabilities carry a Medium (5.4) or Low (3.5) CVSSv3 severity score.
- Attackers could inject malicious scripts or bypass security features.
- Users should update Adobe Experience Manager to patched versions immediately.
On September 8, 2026, Adobe disclosed a significant batch of 25 vulnerabilities affecting its Experience Manager product. The vulnerabilities, all disclosed on the same day, primarily consist of stored and DOM-based Cross-Site Scripting (XSS) flaws, with one instance of improper input validation leading to a security feature bypass. These vulnerabilities could allow low-privileged attackers to inject malicious scripts into form fields or manipulate the DOM, potentially leading to the execution of arbitrary JavaScript in a victim's browser.
The majority of the disclosed vulnerabilities fall into two main categories: stored XSS and DOM-based XSS. CVEs CVE-2026-79905, CVE-2026-75742, CVE-2026-75741, CVE-2026-75740, CVE-2026-75739, CVE-2026-75738, CVE-2026-75737, CVE-2026-75736, CVE-2026-75735, CVE-2026-75734, CVE-2026-75733, CVE-2026-75731, CVE-2026-75730, CVE-2026-75729, and CVE-2026-75727 are all described as stored XSS vulnerabilities. These could be abused by attackers to inject malicious scripts into vulnerable form fields, which would then execute when a victim browses to the affected page.
A separate group of vulnerabilities, CVE-2026-75725, CVE-2026-75724, CVE-2026-75722, CVE-2026-75720, CVE-2026-75719, CVE-2026-75718, CVE-2026-75717, CVE-2026-75716, and CVE-2026-75715, are identified as DOM-based XSS vulnerabilities. These flaws can be exploited by an attacker manipulating the DOM environment to execute malicious JavaScript within the context of a victim's browser, typically requiring user interaction.
Additionally, CVE-2026-75726 presents a different risk, being an improper input validation vulnerability. This could allow a low-privileged attacker to bypass security features and gain unauthorized limited write access to the system.
The severity of these vulnerabilities ranges from Low (CVSSv3 3.5) for CVE-2026-75726 to Medium (CVSSv3 5.4) for all other disclosed CVEs. While no specific threat actor or exploitation campaign has been mentioned in relation to this batch, the nature of XSS vulnerabilities means they can be used for various malicious purposes, including session hijacking, phishing, and redirecting users to malicious sites.
Adobe has addressed these vulnerabilities, and users are advised to update their Adobe Experience Manager instances to the latest patched versions. Specific version information for the patches is typically detailed in Adobe's official security advisories. Staying current with updates is crucial for mitigating the risks associated with these types of client-side vulnerabilities.
This coordinated disclosure of numerous XSS and related vulnerabilities highlights the importance of regular security patching for Adobe Experience Manager deployments. Users should prioritize applying the available updates to protect against potential exploitation and maintain the integrity of their systems and user data. The sheer volume of similar vulnerabilities disclosed together suggests a potential systemic issue within the affected components that has now been addressed by the vendor.