CVE-2026-72626: Adobe Experience Manager DOM XSS Vulnerability

CVE-2026-72626 Overview

Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-72626. The flaw allows an attacker to manipulate the Document Object Model (DOM) environment and execute malicious JavaScript in the victim's browser context. Exploitation requires user interaction: the target must visit a crafted webpage. The vulnerability carries a changed scope, meaning impact extends beyond the vulnerable component. Adobe classified the issue with CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
An authenticated attacker can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, or unauthorized actions across the AEM application.

Affected Products

Adobe Experience Manager (AEM) — see Adobe Security Bulletin APSB26-98 for affected versions
Adobe Experience Manager Cloud Service deployments referenced in the vendor advisory
Adobe Experience Manager on-premises installations within the version ranges listed by Adobe

Discovery Timeline

2026-09-08 - CVE-2026-72626 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-72626

Vulnerability Analysis

CVE-2026-72626 is a DOM-based XSS flaw [CWE-79] in Adobe Experience Manager. Unlike reflected or stored XSS, DOM-based XSS occurs entirely in the browser when client-side JavaScript writes attacker-controlled data into a sink such as innerHTML, document.write, or eval without sanitization. The attacker manipulates values that flow through the DOM to trigger script execution within the AEM origin.

The changed scope indicates that successful exploitation impacts resources beyond the vulnerable component. In an AEM context, this typically means script execution in an authenticated author or publish session can pivot to other application surfaces or user contexts.

Root Cause

The root cause is improper neutralization of user-controllable input that reaches a client-side DOM sink. AEM's JavaScript logic consumes values from a URL fragment, query parameter, or postMessage source and inserts them into the page without adequate encoding or validation. This allows crafted input to be interpreted as executable script rather than data.

Attack Vector

Exploitation is network-based and requires low privileges plus user interaction. An attacker with a low-privileged AEM account crafts a URL containing a malicious payload and lures a higher-privileged user to open it. When the browser processes the page, the injected script executes with the victim's permissions. Successful exploitation can result in limited disclosure or modification of data within the victim's session.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-72626

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event-handler attributes appearing in AEM URL parameters or fragments in web server and CDN access logs
Outbound browser requests from authenticated AEM sessions to attacker-controlled domains carrying session tokens or cookies
Anomalous DOM modifications in browser telemetry originating from AEM author or publish endpoints

Detection Strategies

Inspect AEM access logs for URL parameters containing encoded script payloads such as %3Cscript%3E, onerror=, or javascript: sequences
Deploy a Content Security Policy (CSP) in report-only mode to surface unauthorized inline script execution attempts within AEM pages
Use a web application firewall (WAF) with signatures for DOM XSS payload patterns targeting AEM endpoints

Monitoring Recommendations

Correlate authentication events with anomalous outbound HTTP requests from AEM author sessions to detect session token exfiltration
Monitor for unusual clipboard, form submission, or content modification activity performed by low-privileged AEM users
Alert on CSP violation reports referencing inline scripts or untrusted script sources loaded within the AEM origin

How to Mitigate CVE-2026-72626

Immediate Actions Required

Apply the security update referenced in Adobe Security Bulletin APSB26-98 to all affected AEM instances
Inventory AEM author and publish environments, including Cloud Service and on-premises deployments, and prioritize internet-exposed instances
Review AEM account privileges and enforce least privilege for content authors and contributors

Patch Information

Adobe published the fix in security bulletin APSB26-98. Administrators should review the bulletin for the specific AEM versions and service packs that remediate CVE-2026-72626 and schedule updates according to their change management process. Refer to the Adobe Security Bulletin APSB26-98 for official guidance.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Deploy WAF rules that block requests containing common DOM XSS payload patterns in query strings and fragments targeting AEM paths
Restrict access to AEM author instances using VPN, IP allowlisting, or reverse proxy authentication until patches are applied

bash

# Example nginx rule blocking common XSS payload patterns in query strings
location / {
    if ($args ~* "(<script|javascript:|onerror=|onload=|%3Cscript)") {
        return 403;
    }
    proxy_pass http://aem_backend;
}