CVE-2026-75667: Adobe Experience Manager XSS Vulnerability

CVE-2026-75667 Overview

CVE-2026-75667 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM). An attacker can manipulate the Document Object Model (DOM) environment to execute arbitrary JavaScript within the victim's browser session. Exploitation requires an authenticated attacker with low privileges and user interaction, where the victim must visit a crafted webpage. The vulnerability carries a changed scope, allowing the injected script to affect resources beyond the vulnerable component. The flaw is categorized under [CWE-79], improper neutralization of input during web page generation.

Critical Impact
Successful exploitation enables script execution in the victim's browser context, leading to session data theft, unauthorized actions on behalf of the user, or client-side manipulation of AEM administrative interfaces.

Affected Products

Adobe Experience Manager (AEM)
Refer to Adobe Security Advisory APSB26-98 for specific affected versions
Both AEM Cloud Service and on-premises deployments should be validated against the advisory

Discovery Timeline

2026-09-08 - CVE-2026-75667 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75667

Vulnerability Analysis

The vulnerability resides in client-side JavaScript that processes attacker-controllable input without proper sanitization before writing it to the DOM. Unlike reflected or stored XSS, DOM-based XSS executes entirely within the browser. The malicious payload never reaches server-side logging or filtering in a form that would trigger traditional server-side defenses.

An authenticated attacker with low-level privileges in AEM can craft a URL or webpage that, when visited by a victim, triggers unsafe DOM manipulation. The script executes in the origin of the AEM instance, allowing the attacker to interact with the application as the victim. The changed scope indicates that the impact extends beyond the vulnerable component, potentially affecting other trust boundaries within the browser.

Root Cause

The root cause is improper neutralization of user-supplied data used in client-side sinks such as innerHTML, document.write, or JavaScript event handlers. When AEM client-side code reads from sources like location.hash, location.search, or postMessage data and passes that data to a dangerous sink without encoding, an attacker can inject executable script.

Attack Vector

The attack path requires the victim to visit a crafted webpage while authenticated to the affected AEM instance. The attacker constructs a URL containing a malicious payload in a fragment or query parameter. When the victim loads the page, vulnerable client-side script parses the input and injects it into the DOM as executable JavaScript. The script then runs with the victim's session privileges within the AEM origin.

No code example is provided because a verified proof-of-concept for this vulnerability is not publicly available. Refer to the Adobe Security Advisory APSB26-98 for vendor-provided technical details.

Detection Methods for CVE-2026-75667

Indicators of Compromise

Unexpected outbound requests from user browsers to attacker-controlled domains originating from AEM pages
AEM access logs showing unusual URL fragments or query parameters containing JavaScript syntax such as <script>, javascript:, or onerror=
Session tokens or authentication cookies appearing in third-party referrer logs
Unauthorized content modifications or workflow actions performed by legitimate user accounts

Detection Strategies

Deploy Content Security Policy (CSP) reporting to capture inline script violations and unauthorized script sources
Monitor web application firewall (WAF) logs for request patterns containing common XSS payload signatures
Correlate authenticated AEM sessions with anomalous client-side behavior such as rapid API calls or privilege changes
Perform periodic DOM sink analysis on AEM component JavaScript to identify unsanitized data flows

Monitoring Recommendations

Enable verbose logging on AEM dispatcher and origin servers to capture full request URIs including fragments where possible
Ingest browser telemetry and WAF logs into a centralized data lake for cross-source correlation
Alert on repeated failed CSP violations from the same user session, which may indicate exploitation attempts
Track administrator and content author accounts for out-of-pattern activity following suspicious page visits

How to Mitigate CVE-2026-75667

Immediate Actions Required

Apply the security update referenced in Adobe Security Advisory APSB26-98 to all affected AEM instances
Inventory all AEM deployments including author, publish, and dispatcher tiers to confirm patch coverage
Review AEM user accounts and remove unnecessary low-privilege access that could be leveraged for exploitation
Notify content authors and administrators about phishing risks that could deliver crafted URLs

Patch Information

Adobe has published a security update for Adobe Experience Manager as documented in Adobe Security Advisory APSB26-98. Administrators should consult the advisory for exact fixed versions and apply the update through standard AEM patching procedures. AEM as a Cloud Service customers should confirm their instance is running a build that includes the fix.

Workarounds

Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Configure the AEM dispatcher to filter or reject requests containing suspicious characters in URL fragments and query parameters
Enforce short session timeouts and require re-authentication for sensitive administrative actions
Train content authors to avoid clicking untrusted links while authenticated to AEM administrative interfaces

bash

# Example Content Security Policy header for AEM responses
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report