CVE-2026-75669: Adobe Experience Manager XSS Vulnerability

CVE-2026-75669 Overview

Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-75669. An attacker can manipulate the Document Object Model (DOM) to execute arbitrary JavaScript in the victim's browser context. Exploitation requires user interaction, specifically visiting a crafted webpage. The scope is changed, meaning executed script can affect resources beyond the vulnerable component's security authority. Adobe published the fix in security advisory APSB26-98. The issue is classified under [CWE-79], Improper Neutralization of Input During Web Page Generation.

Critical Impact
An authenticated attacker can execute JavaScript in a victim's browser session, enabling session data theft, unauthorized actions in AEM, and potential lateral movement across trusted origins due to the changed scope.

Affected Products

Adobe Experience Manager (on-premise) prior to the patched release
Adobe Experience Manager Cloud Service
Adobe Experience Manager 6.5 LTS (including SP1 and SP2)

Discovery Timeline

2026-09-08 - CVE-2026-75669 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75669

Vulnerability Analysis

CVE-2026-75669 is a DOM-based XSS flaw in Adobe Experience Manager. Unlike reflected or stored XSS, DOM-based XSS occurs entirely within the client-side JavaScript. Vulnerable script reads attacker-controlled data from a DOM source such as document.location, document.URL, or window.name. That data flows into a dangerous sink like innerHTML, document.write, or eval without sanitization.

The scope change indicated by the CVSS vector means script executed via this flaw can act on resources outside the vulnerable component's security context. In an AEM deployment, this can extend the blast radius to author, publish, or dispatcher tiers sharing browser trust with the affected component.

Exploitation requires an authenticated user with low privileges. The victim must also be tricked into loading an attacker-crafted URL or page. Successful exploitation yields limited confidentiality and integrity impact on the browser session.

Root Cause

The root cause is improper neutralization of untrusted input processed by client-side JavaScript. AEM code accepts values from a DOM source and writes them into an execution sink without escaping or validation. This allows an attacker-supplied payload to be parsed as HTML or JavaScript by the browser.

Attack Vector

The attack vector is network-based. An attacker crafts a URL or webpage that embeds a malicious payload in a DOM source AEM's client code trusts. When an authenticated AEM user loads the page, the browser executes the injected JavaScript under the AEM origin. The attacker can then read session tokens, submit requests to AEM endpoints as the victim, or pivot to other resources exposed by the changed scope.

Refer to the Adobe Security Advisory APSB26-98 for vendor technical details. No public proof-of-concept exploit is currently available.

Detection Methods for CVE-2026-75669

Indicators of Compromise

Unusual AEM authoring or admin requests originating from browsers immediately after a user loaded an external referrer
Requests to AEM endpoints containing script tags, javascript: URIs, or encoded HTML in query parameters or URL fragments
Unexpected outbound calls from AEM user browsers to attacker-controlled domains carrying session identifiers or cookies

Detection Strategies

Deploy a web application firewall rule set that inspects query strings and URL fragments for XSS payload patterns targeting AEM paths
Enable and review AEM access logs for anomalous parameters on /content, /libs, and /apps routes
Correlate browser-side Content Security Policy (CSP) violation reports with AEM authenticated sessions to identify injection attempts

Monitoring Recommendations

Alert on authenticated AEM sessions triggering rapid privilege-sensitive API calls following external referrers
Monitor dispatcher and publish tier logs for requests containing DOM sink keywords such as innerHTML, document.write, or unescaped <script> fragments
Track user-agent and geolocation anomalies for high-privilege AEM accounts to detect session hijacking following XSS

How to Mitigate CVE-2026-75669

Immediate Actions Required

Apply the Adobe security update referenced in advisory APSB26-98 to all AEM on-premise, AEM 6.5 LTS, and AEM Cloud Service tenants
Enforce a strict Content Security Policy on AEM author and publish instances to limit inline script execution
Rotate authenticated session cookies and administrative credentials after patch deployment as a precaution

Patch Information

Adobe released fixed builds addressed in Adobe Security Advisory APSB26-98. AEM Cloud Service customers receive the update automatically through Adobe's managed release channel. On-premise AEM 6.5 LTS operators must install the corresponding service pack or hotfix identified in the advisory.

Workarounds

Restrict AEM author access to trusted networks using VPN or IP allowlisting until patching completes
Deploy WAF signatures that block requests containing common DOM-XSS payload patterns targeting AEM URLs
Educate content authors and administrators to avoid clicking untrusted links while authenticated to AEM

bash

# Example dispatcher filter to block suspicious script payloads in query strings
/0100 { /type "deny" /url '*<script*' }
/0101 { /type "deny" /url '*javascript:*' }
/0102 { /type "deny" /url '*onerror=*' }