CVE-2026-75668: Adobe Experience Manager DOM-based XSS Flaw

CVE-2026-75668 Overview

CVE-2026-75668 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM). An attacker can manipulate the Document Object Model (DOM) environment to execute arbitrary JavaScript in the victim's browser session. Exploitation requires user interaction, specifically that a victim visits a crafted webpage. The vulnerability has a changed scope, meaning the impact extends beyond the vulnerable component. The weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to run malicious JavaScript in the victim's browser, potentially leading to session token theft, credential harvesting, or unauthorized actions performed on behalf of the authenticated user.

Affected Products

Adobe Experience Manager (AEM) — versions listed in Adobe Security Advisory APSB26-98
Adobe Experience Manager Cloud Service deployments
On-premises AEM installations exposed to authenticated users

Discovery Timeline

2026-09-08 - CVE-2026-75668 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database
2026-09-08 - Adobe published Security Advisory APSB26-98

Technical Details for CVE-2026-75668

Vulnerability Analysis

The vulnerability is a DOM-based XSS flaw in Adobe Experience Manager. Client-side JavaScript in AEM processes attacker-controlled input from the DOM without proper sanitization or output encoding. When a victim loads a crafted URL or webpage, malicious script executes within the origin of the AEM application.

Because the scope is changed, injected script can affect resources beyond the vulnerable component's security authority. Attackers can leverage this to interact with authenticated sessions, read accessible page content, or trigger authorized actions on behalf of the victim. The requirement for user interaction and low-privilege authentication limits mass exploitation but does not preclude targeted attacks against AEM authors and administrators.

Root Cause

The root cause is improper neutralization of untrusted input reaching a DOM sink. Client-side code likely writes attacker-controlled data into an execution context such as innerHTML, document.write, eval, or an event handler property without sanitization. AEM does not validate or encode the input before it reaches the sink, allowing script tags or JavaScript URIs to execute.

Attack Vector

Exploitation requires an attacker to craft a malicious URL or webpage referencing the vulnerable AEM endpoint. The attacker must convince an authenticated AEM user with at least low privileges to visit the crafted resource. Once loaded, the vulnerable client-side handler parses the crafted DOM values and executes attacker JavaScript in the AEM origin.

The attack requires no elevated privileges on the target, but does require valid low-privilege authentication to the AEM instance. Confidentiality and integrity impact are limited but non-zero, and no direct availability impact is expected. Refer to Adobe Security Advisory APSB26-98 for technical specifics.

Detection Methods for CVE-2026-75668

Indicators of Compromise

Unusual URL parameters, fragments, or hash values containing <script>, javascript:, or encoded script payloads in AEM access logs
Outbound HTTP requests from browser sessions to attacker-controlled domains immediately after loading an AEM page
Unexpected creation, modification, or publication of AEM content by authenticated author accounts
Session tokens or authentication cookies appearing in referer headers to external hosts

Detection Strategies

Deploy a Web Application Firewall (WAF) rule set to inspect and log requests containing common XSS payload patterns targeting AEM endpoints
Enable a strict Content Security Policy (CSP) with reporting to capture script execution violations in AEM author and publish tiers
Correlate AEM audit logs with browser telemetry to identify anomalous DOM manipulation events during author sessions

Monitoring Recommendations

Monitor AEM access logs for suspicious query strings, fragments, and referer values across /content, /apps, and /etc paths
Alert on authenticated user sessions generating outbound connections to newly registered or uncategorized domains
Track failed CSP reports and correlate them with user accounts, source IPs, and browser fingerprints

How to Mitigate CVE-2026-75668

Immediate Actions Required

Apply the security update referenced in Adobe Security Advisory APSB26-98 to all affected AEM instances
Restrict AEM author interface access to trusted networks and VPN-authenticated users
Enforce phishing-resistant multi-factor authentication for all AEM accounts to reduce risk from targeted lures
Review recent AEM author activity for unauthorized content changes or configuration modifications

Patch Information

Adobe released patches addressing CVE-2026-75668 as part of Security Advisory APSB26-98 on September 8, 2026. Administrators should consult the Adobe Security Advisory APSB26-98 for the exact fixed versions and upgrade guidance for both AEM Cloud Service and on-premises deployments.

Workarounds

Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Configure a WAF to block requests containing common DOM XSS payloads targeting AEM endpoints
Limit AEM author access to trusted internal networks until patching is complete

bash

# Example Content Security Policy header for AEM (dispatcher configuration)
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"