CVE-2026-75637: Adobe Experience Manager DOM XSS Vulnerability

CVE-2026-75637 Overview

CVE-2026-75637 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager. An attacker can manipulate the Document Object Model (DOM) environment to execute arbitrary JavaScript in the context of a victim's browser session. Exploitation requires user interaction, specifically that the victim visits a crafted webpage. The vulnerability has a changed scope, meaning successful exploitation can impact resources beyond the vulnerable component. The flaw is categorized under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact

An authenticated attacker can execute malicious JavaScript in a victim's browser, potentially leading to session compromise, credential theft, or unauthorized actions within the Adobe Experience Manager environment.

Affected Products

• Adobe Experience Manager (specific version details available in the vendor advisory)

Discovery Timeline

• 2026-09-08 - CVE-2026-75637 published to NVD
• 2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75637

Vulnerability Analysis

CVE-2026-75637 is a client-side DOM-based XSS flaw in Adobe Experience Manager (AEM). Unlike reflected or stored XSS, the injection occurs entirely within the browser when client-side JavaScript writes attacker-controlled data into a DOM sink without proper sanitization. The attacker crafts a URL or webpage that manipulates DOM properties consumed by AEM client scripts. When a victim visits the crafted page, the payload executes in the origin of the AEM application. The changed scope indicates that compromise of the vulnerable component can affect other security authorities, such as adjacent iframes, subdomains, or user session tokens.

Root Cause

The root cause is improper neutralization of user-controllable input that flows into a DOM sink such as innerHTML, document.write, or eval. Client-side code in AEM parses attacker-influenced values from sources like location.hash, location.search, or postMessage data and inserts them into the page without contextual output encoding. This allows script content to be interpreted as executable JavaScript rather than inert data.

Attack Vector

The attack vector is network-based and requires low privileges plus user interaction. An authenticated attacker with limited AEM access creates a malicious link or hosts a crafted page. The victim, who must have an active AEM session, is enticed to visit the resource. Upon rendering, vulnerable client-side JavaScript processes the attacker's payload and executes it within the victim's browser session. Because scope is changed, the attacker can leverage the executed script to interact with resources beyond the initial vulnerable component.

No verified public proof-of-concept code is available. Refer to the Adobe Experience Manager Security Advisory for authoritative technical details.

Detection Methods for CVE-2026-75637

Indicators of Compromise

• Unusual URL parameters or fragments containing HTML tags, javascript: schemes, or event handler attributes such as onerror= or onload= in AEM request logs.
• Outbound requests from user browsers to unfamiliar domains immediately following AEM page loads, suggesting data exfiltration via injected script.
• Unexpected session token or cookie access patterns originating from authenticated AEM user sessions.

Detection Strategies

• Deploy a Content Security Policy (CSP) in report-only mode to surface script executions from unauthorized inline sources or external origins.
• Inspect web server and CDN logs for query strings and URL fragments containing encoded script payloads or DOM sink identifiers.
• Correlate authenticated AEM session activity with anomalous JavaScript-initiated network requests using web application firewall telemetry.

Monitoring Recommendations

• Enable browser-side error and CSP violation reporting to a centralized log destination for review.
• Monitor AEM access logs for requests containing suspicious # fragments, since fragments are not typically sent to the server and require client-side capture.
• Alert on any AEM administrative account activity that follows a suspected phishing or crafted-link delivery event.

How to Mitigate CVE-2026-75637

Immediate Actions Required

• Apply the Adobe security update referenced in advisory APSB26-98 to all affected Adobe Experience Manager instances.
• Review and restrict AEM author and publish instance access to trusted networks where feasible.
• Educate authenticated AEM users about the risk of clicking untrusted links while logged into the platform.

Patch Information

Adobe has released a security patch documented in the Adobe Experience Manager Security Advisory APSB26-98. Administrators should consult the advisory for exact fixed versions and apply updates according to Adobe's guidance.

Workarounds

• Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
• Deploy a web application firewall rule to filter or block requests containing suspicious DOM XSS payload patterns targeting AEM endpoints.
• Where patching is delayed, restrict AEM author instance exposure to VPN or internal networks only.

# Example Content Security Policy header for AEM dispatcher configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report"