CVE-2026-75652: Adobe Experience Manager DOM XSS Vulnerability

CVE-2026-75652 Overview

CVE-2026-75652 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM). Attackers can manipulate the Document Object Model (DOM) environment to execute arbitrary JavaScript in a victim's browser session. Exploitation requires user interaction: the victim must visit a crafted webpage. The vulnerability has a changed scope, meaning code execution can affect resources beyond the vulnerable component. The flaw is classified under CWE-79, Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute malicious JavaScript in the context of an authenticated AEM user, potentially leading to session compromise, content manipulation, or credential theft.

Affected Products

Adobe Experience Manager (AEM) — refer to the Adobe Experience Manager Security Advisory APSB26-98 for exact affected versions
Adobe Experience Manager Cloud Service deployments
Adobe Experience Manager on-premise instances

Discovery Timeline

2026-09-08 - CVE-2026-75652 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-75652

Vulnerability Analysis

CVE-2026-75652 is a client-side XSS flaw rooted in unsafe handling of DOM data within Adobe Experience Manager. Unlike reflected or stored XSS, DOM-based XSS executes entirely in the browser when client-side JavaScript writes attacker-controlled data into a sink such as innerHTML, document.write, or eval without sanitization. The scope change indicator means the injected script can affect security-relevant resources beyond the vulnerable component, such as authenticated administrative sessions. Attackers require low-privilege access on the network and user interaction to trigger the payload.

Root Cause

The root cause is improper neutralization of input used to construct DOM content within AEM's client-side code. When JavaScript reads from an attacker-influenced source such as location.hash, location.search, or postMessage data and passes it to an unsafe sink, the browser interprets injected markup as executable script. Adobe's advisory identifies the issue as [CWE-79], and remediation involves proper output encoding and safe DOM API usage.

Attack Vector

An attacker crafts a malicious URL or webpage containing a JavaScript payload targeting an AEM instance. The victim, authenticated with low-level privileges to AEM, is lured into visiting the crafted page. Client-side scripts in AEM process the tainted input and inject it into the DOM, causing browser execution of the attacker's JavaScript under the origin of the AEM application. The vulnerability manifests in DOM sinks within AEM client-side components. See the Adobe Experience Manager Security Advisory for technical details.

Detection Methods for CVE-2026-75652

Indicators of Compromise

Unexpected outbound HTTP requests from AEM author or publish instances to attacker-controlled domains following user navigation
Anomalous JavaScript execution or DOM mutations in browser telemetry from users accessing AEM URLs with unusual query strings or fragments
HTTP referrer logs showing AEM users arriving from suspicious external pages
Session token reuse from geographically inconsistent locations after AEM access

Detection Strategies

Inspect web server and reverse proxy logs for AEM requests containing suspicious patterns in URL fragments, query parameters, or postMessage handlers
Deploy Content Security Policy (CSP) reporting to capture inline script violations that indicate XSS attempts
Correlate browser endpoint telemetry with AEM access logs to identify script execution anomalies
Review AEM user activity for unauthorized content changes made through hijacked sessions

Monitoring Recommendations

Enable verbose logging on AEM Dispatcher and reverse proxy layers for full request URIs, including fragments processed client-side
Monitor for spikes in failed CSP directives that could indicate exploitation attempts
Track anomalous administrative actions performed by low-privilege AEM accounts
Alert on browser extensions or endpoint agents reporting DOM-based script injection events

How to Mitigate CVE-2026-75652

Immediate Actions Required

Apply the Adobe security updates referenced in APSB26-98 to all AEM instances
Inventory all AEM author, publish, and Dispatcher nodes and verify patch status
Enforce a restrictive Content Security Policy on AEM domains to limit inline script execution
Review AEM user privilege assignments and remove unnecessary low-privilege accounts that could be abused for exploitation

Patch Information

Adobe has released a security update addressing CVE-2026-75652. Refer to the Adobe Experience Manager Security Advisory APSB26-98 for affected versions, fixed versions, and platform-specific patch guidance. Apply the vendor-provided fixes across all AEM environments, including staging and production.

Workarounds

Configure the AEM Dispatcher to filter and reject requests containing suspicious characters in query strings and fragments before they reach the publish tier
Deploy a Web Application Firewall (WAF) rule set that inspects requests for common XSS payload patterns targeting AEM endpoints
Enable HTTP security headers including Content-Security-Policy, X-Content-Type-Options, and X-Frame-Options on AEM domains
Require multi-factor authentication for all AEM accounts to reduce the impact of session compromise

bash

# Configuration example: restrictive CSP header for AEM responses
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"