CVE-2026-75744 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager 6.5 Forms JEE. A high-privileged attacker can inject malicious JavaScript into vulnerable form fields, which executes when a victim views the affected page. This can result in elevated privileges or session compromise. The vulnerability affects versions from initial releases up to 6.5.25 inclusive. The CVSS v3.1 base score is 8.1, indicating high severity, with network attack vector, low attack complexity, high privileges required, and user interaction needed. The scope is changed, and the impact includes high confidentiality and integrity impact but no availability impact.

Successful exploitation can lead to execution of arbitrary JavaScript in the context of the victim's browser session, potentially allowing attackers to hijack user sessions, escalate privileges, or perform unauthorized actions within the affected application. The vulnerability requires a high-privileged attacker to inject the malicious script and user interaction to trigger the payload. The confidentiality and integrity of affected users' data and sessions are at high risk.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Until a fix is available, restrict high-privileged user access and monitor for suspicious activity related to form inputs. Avoid exposing vulnerable forms to untrusted users.