CVE-2026-75651: Adobe Experience Manager DOM XSS Vulnerability

CVE-2026-75651 Overview

Adobe Experience Manager contains a DOM-based Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-75651. An attacker can manipulate the Document Object Model (DOM) environment to execute arbitrary JavaScript in the victim's browser context. Exploitation requires user interaction, specifically that the victim visits a crafted webpage. The vulnerability has a changed scope, meaning impact can extend beyond the vulnerable component. The issue is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows execution of attacker-controlled JavaScript in the victim's browser session, enabling session token theft, credential harvesting, and unauthorized actions within Adobe Experience Manager.

Affected Products

Adobe Experience Manager (see Adobe Security Advisory APSB26-98 for affected versions)
Adobe Experience Manager Cloud Service deployments referenced by the advisory
Adobe Experience Manager on-premises installations referenced by the advisory

Discovery Timeline

2026-09-08 - CVE-2026-75651 published to NVD
2026-09-08 - Last updated in NVD database
2026-09-10 - EPSS score assigned at 0.185%

Technical Details for CVE-2026-75651

Vulnerability Analysis

CVE-2026-75651 is a DOM-based XSS flaw in Adobe Experience Manager. DOM-based XSS occurs when client-side JavaScript reads attacker-controllable data from a source such as location.hash, location.search, or document.referrer and writes it to a dangerous sink without proper sanitization. Sinks typically include innerHTML, document.write, and eval.

The scope-changed classification indicates that code executing in the browser can affect resources beyond the vulnerable page. This allows attackers to pivot into authenticated author or publisher sessions when a privileged user visits a crafted URL. Low-privileged attacker access is required to stage the payload, and the victim must interact with the crafted content.

The attack does not compromise the server directly. Instead, it weaponizes trust between the browser and the AEM origin, enabling actions the victim is authorized to perform.

Root Cause

The root cause is insufficient neutralization of untrusted input processed by client-side scripts before being rendered into the DOM. Adobe's advisory (APSB26-98) documents the affected components. Because the sanitization gap exists in browser-executed code, server-side web application firewall (WAF) rules alone offer limited protection.

Attack Vector

The attack vector is network-based and requires the victim to visit a crafted webpage or a URL containing a malicious fragment. The attacker crafts a URL targeting the vulnerable AEM endpoint with a payload embedded in a DOM source. When the victim's browser processes the payload, the vulnerable client-side script writes it into a sensitive DOM sink, and the injected JavaScript executes under the AEM origin.

Adobe has not disclosed exploit code, and no public proof-of-concept exists. See the Adobe Security Advisory APSB26-98 for vendor-provided technical details.

Detection Methods for CVE-2026-75651

Indicators of Compromise

Web server or CDN logs containing AEM URLs with suspicious script fragments such as <script>, javascript:, onerror=, or encoded variants in query strings or URL fragments.
Referrer headers pointing to unfamiliar external domains that redirect users into AEM author or publish endpoints.
Unexpected outbound requests from browser sessions to attacker-controlled hosts shortly after AEM page loads.

Detection Strategies

Deploy content security policy (CSP) violation reporting to capture blocked inline script executions on AEM pages.
Instrument client-side monitoring to flag writes to innerHTML, document.write, and eval originating from AEM-hosted scripts.
Correlate authentication events with anomalous session activity, such as content publishing actions from unusual geographies immediately following URL clicks.

Monitoring Recommendations

Aggregate AEM access logs, CSP reports, and endpoint browser telemetry into a centralized analytics platform for cross-source correlation.
Alert on requests containing URL-encoded script primitives targeting known AEM paths.
Review privileged AEM user sessions for unexpected API calls or content modifications following external link navigation.

How to Mitigate CVE-2026-75651

Immediate Actions Required

Apply the security update referenced in Adobe Security Advisory APSB26-98 to all affected AEM instances.
Inventory all AEM author, publish, and dispatcher tiers to confirm patch coverage across environments.
Rotate session tokens and force reauthentication for privileged AEM users after patching.

Patch Information

Adobe published fixes in advisory APSB26-98. Administrators should consult the advisory for the specific fixed versions applicable to their AEM Cloud Service or on-premises deployments and apply updates through Adobe's standard update channels.

Workarounds

Enforce a strict Content Security Policy on AEM-hosted pages to block inline script execution and restrict script sources.
Configure the AEM dispatcher to filter query parameters and URL fragments containing script primitives before requests reach the publish tier.
Restrict privileged AEM author accounts to trusted networks and require them to avoid clicking untrusted external links while authenticated.

bash

# Example CSP header to reduce DOM XSS impact on AEM responses
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report