CVE-2026-75635: Adobe Experience Manager DOM XSS Vulnerability

CVE-2026-75635 Overview

CVE-2026-75635 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM). An attacker manipulates the Document Object Model (DOM) environment to execute arbitrary JavaScript in the victim's browser session. Exploitation requires user interaction, as the victim must visit a crafted webpage. The vulnerability has a changed scope, meaning impact extends beyond the vulnerable component's security authority. The flaw is categorized under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute malicious JavaScript in the victim's browser, enabling session compromise, credential theft, and unauthorized actions within the AEM context.

Affected Products

Adobe Experience Manager (AEM) — see Adobe Security Advisory APSB26-98 for affected versions

Discovery Timeline

2026-09-08 - CVE-2026-75635 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-75635

Vulnerability Analysis

CVE-2026-75635 is a DOM-based XSS flaw in Adobe Experience Manager. Unlike reflected or stored XSS, DOM-based XSS occurs entirely client-side, where untrusted input flows into a JavaScript sink that modifies the DOM without proper sanitization. An attacker crafts a URL or webpage that causes the AEM client-side JavaScript to write attacker-controlled data into a dangerous sink such as innerHTML, document.write, or eval.

The scope change indicates the vulnerable component and the impacted component differ. JavaScript executed in the AEM context can access resources or data belonging to other security authorities. Exploitation requires an authenticated user with low privileges to interact with a crafted page.

Root Cause

The root cause is improper neutralization of user-controlled input before it reaches a client-side DOM sink. AEM JavaScript code processes attacker-influenced values (such as URL fragments, query parameters, or postMessage data) and inserts them into the DOM without adequate encoding or validation, allowing script execution.

Attack Vector

The attack vector is network-based with required user interaction. An attacker delivers a crafted URL or hosts a malicious page that triggers the vulnerable AEM client-side logic. When the victim visits the page, the DOM sink executes the injected JavaScript in the victim's browser under the AEM origin. Refer to the Adobe Security Advisory APSB26-98 for vendor-specific technical details.

Detection Methods for CVE-2026-75635

Indicators of Compromise

Unexpected outbound HTTP requests from user browsers to attacker-controlled domains following AEM page visits
Anomalous JavaScript execution or DOM mutations in AEM-hosted pages, particularly involving URL fragments or query parameters passed to sinks like innerHTML or eval
Session tokens or authentication cookies observed being transmitted to unrecognized third-party endpoints

Detection Strategies

Deploy Content Security Policy (CSP) reporting to capture inline script violations and unauthorized script sources on AEM domains
Review web server and CDN logs for suspicious URL patterns containing script fragments, HTML entities, or JavaScript keywords in query strings and fragments
Perform static and dynamic analysis of AEM client-side JavaScript to identify unsafe DOM sinks receiving untrusted input

Monitoring Recommendations

Monitor AEM author and publish instances for unusual authentication events or session anomalies indicating hijacked sessions
Alert on browser telemetry showing credential submission to non-AEM hostnames originating from AEM-hosted pages
Correlate user activity logs with URL parameters to identify targeted phishing campaigns delivering malicious links to internal users

How to Mitigate CVE-2026-75635

Immediate Actions Required

Apply the security update referenced in Adobe Security Advisory APSB26-98 to all Adobe Experience Manager instances
Inventory all AEM author, publish, and dispatcher instances to confirm patch coverage across production and non-production environments
Notify AEM users about the risk of clicking untrusted links until patching is complete

Patch Information

Adobe has released a security update addressing CVE-2026-75635. Consult the Adobe Security Advisory APSB26-98 for affected versions, fixed builds, and installation guidance. Apply the patch on all AEM tiers, including author, publish, and dispatcher components, and verify remediation through post-patch validation testing.

Workarounds

Enforce a strict Content Security Policy (CSP) on AEM domains to block inline scripts and restrict script sources to trusted origins
Configure the AEM dispatcher to filter suspicious query parameters and URL fragments containing script-like payloads
Restrict AEM author interface access to trusted networks or VPN-connected users to reduce exposure to crafted external links