CVE-2026-75647: Adobe Experience Manager DOM XSS Vulnerability

CVE-2026-75647 Overview

CVE-2026-75647 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager [CWE-79]. An attacker can manipulate the Document Object Model (DOM) environment to execute arbitrary JavaScript within the context of the victim's browser session. Exploitation requires user interaction: the victim must visit a crafted webpage while authenticated. The vulnerability has a changed scope, meaning executed script can affect resources beyond the vulnerable component's security authority. Adobe published details in security advisory APSB26-98.

Critical Impact
Successful exploitation allows attackers to execute JavaScript in the victim's authenticated Adobe Experience Manager session, enabling session data theft, unauthorized actions, and content manipulation across security boundaries.

Affected Products

Adobe Experience Manager (see Adobe Security Advisory APSB26-98 for affected versions)

Discovery Timeline

2026-09-08 - CVE-2026-75647 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-75647

Vulnerability Analysis

CVE-2026-75647 is a client-side injection flaw where untrusted input flows into a DOM sink without proper sanitization or encoding. Unlike reflected or stored XSS, the malicious payload never reaches the server. The vulnerable JavaScript reads attacker-controlled data from sources such as document.location, document.URL, or window.name and writes it to sinks like innerHTML, document.write, or eval. The browser then parses and executes the injected script within the origin of the Adobe Experience Manager application.

Because the scope is changed, script executed through this flaw can influence components beyond the initially vulnerable module. The attacker requires low-level privileges on the target application, meaning an authenticated user context is necessary for the intended impact chain.

Root Cause

The root cause is improper neutralization of input during web page generation on the client side [CWE-79]. Client-side scripts in Adobe Experience Manager consume URL parameters or fragment identifiers and inject them into the DOM without applying context-appropriate encoding. Adobe has not published low-level technical details of the affected code path.

Attack Vector

The attack vector is network-based with required user interaction. An attacker crafts a URL containing a malicious payload embedded in a parameter or fragment consumed by client-side code. The attacker delivers the URL through phishing, malicious advertising, or a compromised third-party site. When an authenticated Adobe Experience Manager user visits the URL, the browser executes attacker-controlled JavaScript within the application's origin. Full technical details are available in the Adobe Security Advisory APSB26-98.

Detection Methods for CVE-2026-75647

Indicators of Compromise

Unusual URL parameters or fragment identifiers in web server access logs containing script tags, event handlers such as onerror=, or javascript: URIs targeting Adobe Experience Manager endpoints.
Browser Content Security Policy (CSP) violation reports referencing inline script execution on Adobe Experience Manager pages.
Anomalous outbound requests from authenticated author or publish sessions to attacker-controlled domains.

Detection Strategies

Deploy a web application firewall rule set that inspects request URIs and fragments for common XSS payloads directed at Adobe Experience Manager paths.
Enable and monitor CSP report-uri or report-to endpoints to capture injection attempts blocked by the browser.
Correlate authentication events with atypical DOM-modifying activity or session token access from unfamiliar geolocations.

Monitoring Recommendations

Review Adobe Experience Manager access logs for requests containing encoded script fragments (%3Cscript, %22onerror, javascript%3A).
Monitor for unexpected outbound network traffic from browsers of privileged Adobe Experience Manager users.
Track user-agent patterns and referrer headers on Adobe Experience Manager login and content editing endpoints to identify social-engineering campaigns.

How to Mitigate CVE-2026-75647

Immediate Actions Required

Apply the security update referenced in Adobe Security Advisory APSB26-98 to all Adobe Experience Manager instances.
Restrict administrative and author access to Adobe Experience Manager to trusted networks or VPN-authenticated users.
Educate content authors and administrators about the risk of clicking untrusted links while authenticated to Adobe Experience Manager.

Patch Information

Adobe released fixes for CVE-2026-75647 as part of security bulletin APSB26-98. Consult the Adobe Security Advisory APSB26-98 for affected version numbers and the corresponding fixed releases. Apply the vendor-supplied patch during the next available maintenance window and verify installation across all Adobe Experience Manager author, publish, and dispatcher nodes.

Workarounds

Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Configure the Adobe Experience Manager Dispatcher to filter suspicious query parameters and fragment identifiers before they reach client code.
Enforce short session lifetimes and require re-authentication for privileged operations to limit exposure if a session is hijacked.

bash

# Example Content Security Policy header to reduce XSS impact
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; report-uri /csp-report