CVE-2026-75660: Adobe Experience Manager DOM XSS Vulnerability

CVE-2026-75660 Overview

Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-75660. An attacker can manipulate the Document Object Model (DOM) environment to execute arbitrary JavaScript in the victim's browser session. Successful exploitation requires user interaction, specifically the victim visiting an attacker-crafted webpage. The flaw carries a changed scope, meaning the injected script can affect resources beyond the vulnerable component's original security context. Adobe published details in Security Bulletin APSB26-98.

Critical Impact
Attackers can execute malicious JavaScript in an authenticated user's browser, enabling session theft, defacement, or actions on behalf of the victim within Adobe Experience Manager.

Affected Products

Adobe Experience Manager (AEM)
Refer to Adobe Security Bulletin APSB26-98 for specific affected versions
Both cloud and on-premises AEM deployments should be reviewed

Discovery Timeline

2026-09-08 - CVE-2026-75660 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-75660

Vulnerability Analysis

CVE-2026-75660 is a client-side injection flaw categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation). The vulnerability resides in client-side JavaScript that reads attacker-controllable data from DOM sources and writes it to dangerous sinks without proper sanitization. Because the exploitation occurs entirely in the browser, the malicious payload never needs to traverse the server, making traditional server-side detection ineffective.

The scope-changed designation indicates that the injected script can influence resources managed by a security authority beyond the vulnerable component. In AEM deployments, this can allow scripts running in one origin or component to affect authoring interfaces, publish instances, or content across trust boundaries.

Root Cause

The root cause is unsafe handling of DOM data flows within Adobe Experience Manager's client-side code. User-controllable values, such as URL fragments, query parameters, or document.location properties, are passed to sinks like innerHTML, document.write, or eval without contextual output encoding. This allows an attacker to break out of the intended data context and execute JavaScript.

Attack Vector

Exploitation requires an authenticated AEM user with low privileges to visit a crafted URL. The attacker delivers the URL through phishing, malicious ads, or a compromised third-party site. When the victim's browser processes the page, the vulnerable AEM script reads the attacker-controlled DOM value and executes the embedded payload in the AEM origin. The attacker can then steal session tokens, perform actions as the victim, or pivot to other AEM components through the changed scope.

No verified proof-of-concept code is publicly available. Refer to the Adobe Security Bulletin APSB26-98 for vendor-provided technical details.

Detection Methods for CVE-2026-75660

Indicators of Compromise

Unusual outbound requests from AEM author or publish domains to attacker-controlled hosts carrying session cookies or CSRF tokens
AEM audit log entries showing unexpected content modifications or configuration changes performed by legitimate low-privileged users
Browser console errors or Content Security Policy (CSP) violation reports referencing inline script execution on AEM pages

Detection Strategies

Deploy Content Security Policy headers with report-uri or report-to directives to capture unauthorized script execution attempts
Inspect web server access logs for requests containing suspicious URL fragments, query strings, or encoded JavaScript payloads targeting AEM endpoints
Correlate AEM authentication events with anomalous user activity patterns, such as session reuse from unexpected geographies

Monitoring Recommendations

Enable verbose logging on AEM dispatcher and author instances to capture request parameters and referrer headers
Forward web application firewall (WAF) and CSP violation reports to a centralized SIEM for correlation
Alert on privileged AEM actions initiated shortly after users click external links, indicating possible XSS-driven session abuse

How to Mitigate CVE-2026-75660

Immediate Actions Required

Apply the security update referenced in Adobe Security Bulletin APSB26-98 to all Adobe Experience Manager instances
Inventory all AEM author, publish, and dispatcher nodes to confirm patch coverage across environments
Rotate AEM administrative and service account credentials if compromise is suspected
Review recent AEM audit logs for content or configuration changes made by low-privileged accounts

Patch Information

Adobe has released updates for affected Adobe Experience Manager versions. Consult the Adobe Security Bulletin APSB26-98 for specific fixed versions and installation guidance. Apply the update to author, publish, and dispatcher tiers.

Workarounds

Enforce a strict Content Security Policy on AEM origins to block inline script execution and restrict allowed script sources
Configure the AEM dispatcher to filter suspicious query parameters and URL fragments before forwarding requests to author or publish instances
Require multi-factor authentication for all AEM users to reduce the impact of session hijacking through XSS
Educate content authors and administrators about phishing links that could trigger DOM-based XSS in authenticated sessions

bash

# Example AEM dispatcher filter rule to block common XSS payload patterns
/0100 { /type "deny" /url '*<script*' }
/0101 { /type "deny" /url '*javascript:*' }
/0102 { /type "deny" /url '*onerror=*' }