CVE-2026-71357: Adobe Experience Manager XSS Vulnerability

CVE-2026-71357 Overview

Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-71357. The flaw allows an attacker to manipulate the Document Object Model (DOM) environment and execute arbitrary JavaScript within the victim's browser session. Exploitation requires user interaction, specifically that the victim visits a crafted webpage. The scope is changed, meaning the impact extends beyond the vulnerable component's security authority. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation permits execution of malicious JavaScript in the victim's browser context, enabling session token theft, credential harvesting, and unauthorized actions against the AEM application.

Affected Products

Adobe Experience Manager (AEM)
Refer to the Adobe Security Advisory APSB26-98 for specific affected version ranges
Both Adobe Experience Manager Cloud Service and on-premises deployments may be impacted per vendor advisory

Discovery Timeline

2026-09-08 - CVE-2026-71357 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-71357

Vulnerability Analysis

CVE-2026-71357 is a DOM-based XSS vulnerability in Adobe Experience Manager. Unlike reflected or stored XSS, DOM-based XSS occurs entirely on the client side. The vulnerable JavaScript reads attacker-controlled data from a source such as document.location, document.referrer, or window.name and passes it to a dangerous sink like innerHTML, document.write, or eval without proper sanitization.

Because the scope changes upon exploitation, the injected script executes with privileges that cross the trust boundary of the vulnerable component. An attacker leveraging this flaw can hijack authenticated AEM author or admin sessions, exfiltrate content, or pivot to other administrative functions accessible through the browser context.

Root Cause

The root cause is improper neutralization of user-controllable input processed by client-side JavaScript within Adobe Experience Manager. Data flows from an untrusted DOM source into an HTML or JavaScript execution sink without encoding or validation. Adobe has not published the specific vulnerable component or script file in the public advisory.

Attack Vector

The attack requires the victim to load a crafted URL or webpage while authenticated to the AEM instance. The malicious payload is embedded in URL fragments, query parameters, or referrer values that the vulnerable client-side code consumes. Upon rendering, the browser executes the attacker's JavaScript within the origin of the AEM application. Low-privilege authentication is required on the attacker side, and user interaction from the victim is mandatory.

No verified exploit code or public proof-of-concept has been published for this vulnerability at the time of writing. Technical details are described in prose per the Adobe Security Advisory APSB26-98.

Detection Methods for CVE-2026-71357

Indicators of Compromise

Unusual outbound HTTP requests from browsers of authenticated AEM users containing session cookies or CSRF tokens in URLs or POST bodies
Unexpected script tags, event handlers, or javascript: URIs in AEM content stores or referenced assets
Web server access logs showing AEM URLs with encoded JavaScript payloads in fragments or query parameters

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query strings, fragments, and referrer headers for JavaScript keywords, encoded angle brackets, and event handler patterns
Enable Content Security Policy (CSP) reporting to capture violation events indicating injected inline scripts or unauthorized script sources
Correlate browser telemetry and endpoint EDR events to identify anomalous script execution originating from AEM domains

Monitoring Recommendations

Monitor AEM author and publisher access logs for repeated requests carrying suspicious URL parameters or encoded payloads
Alert on privileged AEM account activity from atypical geolocations, user agents, or session tokens shortly after users visit external links
Ingest AEM, proxy, and browser telemetry into a centralized SIEM to correlate phishing lures with subsequent AEM session anomalies

How to Mitigate CVE-2026-71357

Immediate Actions Required

Apply the security update referenced in Adobe Security Advisory APSB26-98 to all affected AEM instances
Restrict AEM author and admin console access to trusted networks or VPN-connected users pending patch deployment
Educate content authors and administrators to avoid clicking untrusted links while authenticated to AEM

Patch Information

Adobe has released fixes for CVE-2026-71357 as documented in security bulletin APSB26-98. Administrators should consult the Adobe Security Advisory APSB26-98 for exact fixed versions applicable to Adobe Experience Manager Cloud Service, AEM 6.5 Service Pack releases, and any related components.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Configure the AEM dispatcher to filter or drop requests containing suspicious characters in URL fragments and parameters
Require re-authentication for sensitive AEM administrative actions to limit the impact of session hijacking via XSS

bash

# Example Content Security Policy header for AEM dispatcher (Apache)
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"