CVE-2026-75666: Adobe Experience Manager DOM XSS Vulnerability

CVE-2026-75666 Overview

CVE-2026-75666 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM). An attacker can manipulate the Document Object Model (DOM) environment to execute arbitrary JavaScript within the victim's browser context. Exploitation requires user interaction, specifically that a victim visits a crafted webpage. The scope is changed, meaning the impact can extend beyond the vulnerable component to other browser origins or trust boundaries. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
An authenticated attacker can execute malicious JavaScript in a victim's browser, potentially leading to session compromise, credential theft, or unauthorized actions within the AEM environment.

Affected Products

Adobe Experience Manager (see Adobe Security Advisory APSB26-98 for specific versions)

Discovery Timeline

2026-09-08 - CVE-2026-75666 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-75666

Vulnerability Analysis

CVE-2026-75666 is a DOM-based XSS flaw in Adobe Experience Manager. Unlike reflected or stored XSS, DOM-based XSS occurs entirely in the client-side script. The vulnerable JavaScript reads attacker-controllable data from a DOM source (such as document.location, document.URL, or document.referrer) and passes it to a dangerous sink (such as innerHTML, document.write, or eval) without proper sanitization.

The scope change indicates that successful exploitation crosses a security boundary. In AEM, this typically means that script executed in one context can affect resources protected by a different authority, such as author or admin interfaces reachable from a low-privileged content editor session.

Root Cause

The root cause is improper neutralization of user-controllable input rendered into the DOM by client-side scripts. AEM front-end code processes untrusted URL fragments or query parameters and injects them into DOM sinks without contextual output encoding, allowing the browser to interpret injected content as executable JavaScript.

Attack Vector

Exploitation is network-based and requires low-privileged authentication plus user interaction. An attacker crafts a URL containing malicious JavaScript payloads that target the vulnerable client-side handler. When a victim with an active AEM session visits the crafted link, the payload executes in the browser under the origin of the AEM instance. Because scope is changed, the executed script can access resources or trigger actions outside the immediate component boundary.

No public proof-of-concept exploit or code example is available for this vulnerability. See the Adobe Security Advisory APSB26-98 for vendor-supplied technical details.

Detection Methods for CVE-2026-75666

Indicators of Compromise

Unusual URL parameters or fragments in AEM access logs containing JavaScript keywords such as <script>, javascript:, onerror=, or onload=.
Unexpected outbound requests from user browsers to attacker-controlled domains following AEM page loads.
AEM session tokens or authentication cookies appearing in referrer headers to external hosts.

Detection Strategies

Inspect AEM web server and CDN logs for encoded payloads targeting client-side URL parsers or hash fragments.
Deploy Content Security Policy (CSP) reporting endpoints to capture inline script violations indicative of XSS attempts.
Correlate authenticated AEM session activity with anomalous DOM manipulation events reported by browser telemetry.

Monitoring Recommendations

Enable verbose request logging on AEM dispatcher and origin instances, including full URI and fragment data where operationally feasible.
Monitor for phishing campaigns delivering crafted AEM URLs to authenticated content authors and editors.
Alert on any AEM user account generating outbound requests to unknown domains shortly after clicking external links.

How to Mitigate CVE-2026-75666

Immediate Actions Required

Apply the security update referenced in Adobe Security Advisory APSB26-98 to all affected AEM instances.
Audit AEM user accounts and revoke unnecessary content editor privileges to reduce the exploitable attack surface.
Educate content authors and administrators on the risk of clicking untrusted links while authenticated to AEM.

Patch Information

Adobe has published fixed versions in security bulletin APSB26-98. Administrators should consult the Adobe Security Advisory APSB26-98 for the specific patched builds corresponding to their AEM deployment.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Configure the AEM dispatcher to filter and reject requests containing suspicious script patterns in query strings or fragments.
Restrict access to AEM author instances to trusted networks or via VPN until patches are validated and deployed.

bash

# Example CSP header to reduce DOM XSS impact
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'