CVE-2026-75659: Adobe Experience Manager DOM-Based XSS Flaw

CVE-2026-75659 Overview

CVE-2026-75659 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM). An attacker can manipulate the Document Object Model (DOM) environment to execute arbitrary JavaScript within the victim's browser context. Exploitation requires user interaction: the victim must visit a crafted webpage. The vulnerability carries a changed scope, meaning impact extends beyond the vulnerable component. The issue is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation enables script execution in the victim's browser session, potentially leading to session compromise, credential theft, and unauthorized actions within the AEM application.

Affected Products

Adobe Experience Manager (AEM)
Refer to Adobe Security Advisory APSB26-98 for specific affected versions
Both AEM Cloud Service and on-premises deployments may be impacted per vendor advisory

Discovery Timeline

2026-09-08 - CVE-2026-75659 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-75659

Vulnerability Analysis

The vulnerability is a DOM-based XSS flaw in Adobe Experience Manager. Unlike reflected or stored XSS, DOM-based XSS occurs entirely on the client side. Vulnerable client-side JavaScript reads attacker-controlled data from a source such as location.hash, document.referrer, or window.name, then writes it into a dangerous sink such as innerHTML, document.write, or eval without proper sanitization.

Exploitation requires a low-privileged authenticated context and victim interaction with a crafted URL or webpage. Because the scope is changed, executed script can affect resources beyond the vulnerable AEM component, including other origins or user session data governed by different security authorities.

Root Cause

The root cause is improper neutralization of user-controllable input written to the DOM by client-side scripts in AEM. Data flowing from an untrusted source reaches an execution sink without contextual output encoding or safe DOM APIs such as textContent or setAttribute with allowlisted values.

Attack Vector

An attacker crafts a URL or webpage containing a malicious payload designed to be processed by vulnerable AEM client-side JavaScript. When a victim with an authenticated AEM session visits the crafted page, the payload executes in the browser under the AEM origin, allowing session token access, form manipulation, and content modification within the author or publish interface.

No verified proof-of-concept code is publicly available. See the Adobe Security Advisory APSB26-98 for vendor-provided technical details.

Detection Methods for CVE-2026-75659

Indicators of Compromise

Unusual URL fragments or query parameters containing JavaScript syntax such as <script>, javascript:, onerror=, or encoded variants targeting AEM endpoints
Unexpected outbound requests from browsers of authenticated AEM users to attacker-controlled domains carrying session identifiers or form data
AEM application logs showing referrer values pointing to untrusted third-party domains prior to sensitive actions

Detection Strategies

Deploy Content Security Policy (CSP) reporting to capture inline script execution attempts and violations from AEM origins
Monitor web proxy and endpoint telemetry for anomalous JavaScript execution patterns following navigation to AEM URLs with crafted parameters
Inspect AEM access logs for repeated requests containing encoded payloads targeting known XSS sinks in the DAM, Sites, or Assets modules

Monitoring Recommendations

Correlate authentication events with subsequent anomalous DOM modification or data exfiltration behavior on user endpoints
Alert on browser telemetry indicating script-initiated requests to non-corporate domains during AEM author sessions
Track CSP violation reports and treat spikes as potential exploitation indicators

How to Mitigate CVE-2026-75659

Immediate Actions Required

Apply Adobe's patch as described in Adobe Security Advisory APSB26-98 to all AEM instances
Audit authenticated user accounts and revoke sessions for accounts with unexpected activity following patch deployment
Enforce a strict Content Security Policy on AEM origins to restrict inline script execution and untrusted script sources

Patch Information

Adobe has published fixes in Security Advisory APSB26-98. Administrators should consult the advisory for exact version numbers, service pack requirements, and hotfix identifiers applicable to their AEM deployment model.

Workarounds

Restrict access to the AEM author instance to trusted networks and VPN-connected users to reduce exposure of authenticated sessions
Deploy a web application firewall (WAF) rule to filter requests containing common XSS payload patterns targeting AEM URLs
Educate content authors and administrators to avoid clicking untrusted links while authenticated to the AEM console

bash

# Example CSP header to reduce DOM XSS impact on AEM origins
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report