CVE-2026-75661: Adobe Experience Manager XSS Vulnerability

CVE-2026-75661 Overview

CVE-2026-75661 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM). An attacker can manipulate the Document Object Model (DOM) environment in the victim's browser to execute arbitrary JavaScript within the application context. Exploitation requires user interaction: the victim must visit a crafted webpage. The vulnerability has a changed scope, meaning impact extends beyond the vulnerable component. The issue is categorized under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
A successful attack can execute malicious JavaScript in the victim's browser session, enabling session token theft, unauthorized actions against AEM, and manipulation of rendered content across trust boundaries due to scope change.

Affected Products

Adobe Experience Manager (AEM)
Refer to the Adobe Experience Manager Security Advisory for specific affected versions
Deployments hosting AEM content authoring and delivery interfaces

Discovery Timeline

2026-09-08 - CVE-2026-75661 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-75661

Vulnerability Analysis

The vulnerability resides in client-side JavaScript within Adobe Experience Manager. Attacker-controlled data flows into a DOM sink without proper sanitization or encoding. When the victim loads a crafted URL or page that references the vulnerable AEM resource, the browser interprets injected data as executable script.

Because the flaw manifests entirely in the browser, server-side logging may not capture the payload. The changed scope indicates that successful exploitation affects components outside the vulnerable module, such as parent frames or adjacent origins. Exploitation requires the attacker to hold low-privilege access and the victim to interact with the crafted content.

Root Cause

The root cause is improper neutralization of input written to a DOM sink such as innerHTML, document.write, or eval [CWE-79]. Client-side code consumes untrusted values from sources like location.hash, location.search, or postMessage events and inserts them into the page without contextual encoding. This allows attacker-supplied strings to be parsed as HTML and JavaScript.

Attack Vector

Exploitation follows a network-based attack path. The attacker crafts a URL or webpage containing a malicious payload that targets the vulnerable AEM client-side handler. The attacker delivers this link through phishing, forum posts, or embedded iframes. When an authenticated AEM user visits the resource, the injected script executes with the privileges of the victim's session. Attackers can then exfiltrate authentication cookies, submit forged requests to AEM administrative endpoints, or pivot to adjacent origins due to the changed scope.

No verified public exploit code is available. See the Adobe Experience Manager Security Advisory for vendor-provided technical details.

Detection Methods for CVE-2026-75661

Indicators of Compromise

Unusual outbound HTTP requests from AEM author or publish instances to attacker-controlled domains carrying cookie or token values in query strings
Web server logs showing AEM URLs containing suspicious fragments, encoded <script> tags, or javascript: URIs in query parameters
Content Security Policy (CSP) violation reports referencing inline scripts or unexpected script sources on AEM-hosted pages
Anomalous session activity from authenticated AEM accounts, such as unexpected content publication or user changes

Detection Strategies

Deploy CSP with report-uri or report-to directives to surface DOM-based injection attempts in production AEM instances
Instrument browser telemetry and Real User Monitoring (RUM) to flag execution of unexpected script origins within AEM pages
Correlate web application firewall (WAF) alerts on encoded script payloads with authenticated AEM session activity

Monitoring Recommendations

Ingest AEM dispatcher, author, and publish logs into a centralized SIEM for query-based hunting of suspicious URL patterns
Monitor authenticated user sessions for behavioral anomalies including off-hours logins and rapid privilege changes
Track user agent and referrer patterns for AEM administrative paths to identify targeted phishing campaigns

How to Mitigate CVE-2026-75661

Immediate Actions Required

Apply the security update published in the Adobe Experience Manager Security Advisory APSB26-98 as soon as testing permits
Inventory all AEM instances, including author, publish, and dispatcher tiers, to confirm patch coverage
Notify AEM content authors and administrators of active phishing risk targeting their sessions
Rotate authentication credentials and invalidate active sessions for privileged AEM accounts following patch deployment

Patch Information

Adobe has released a security patch addressing CVE-2026-75661. Consult the Adobe Experience Manager Security Advisory for affected version ranges, fixed releases, and installation instructions specific to on-premises, Adobe Managed Services, and AEM as a Cloud Service deployments.

Workarounds

Enforce a strict Content Security Policy on AEM-hosted pages to restrict inline script execution and limit permitted script sources
Restrict access to AEM author instances behind a VPN or IP allowlist to reduce exposure of privileged users to crafted external links
Enable HttpOnly and Secure attributes on session cookies to reduce token exposure to injected scripts
Deploy a WAF rule set to block requests containing common DOM XSS payload patterns targeting AEM URLs

bash

# Example Content Security Policy header for AEM dispatcher
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; report-uri /csp-report"