CVE-2026-75670: Adobe Experience Manager XSS Vulnerability

CVE-2026-75670 Overview

CVE-2026-75670 is a DOM-based Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Adobe Experience Manager (AEM). An attacker can manipulate the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation requires user interaction, as the victim must visit a crafted webpage. The vulnerability results in a scope change, meaning code executes with impact beyond the initially vulnerable component.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser session, potentially leading to session hijacking, credential theft, or unauthorized actions within the AEM environment.

Affected Products

Adobe Experience Manager (AEM Cloud Service)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS SP1 and SP2

Discovery Timeline

2026-09-08 - CVE-2026-75670 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75670

Vulnerability Analysis

CVE-2026-75670 is a client-side DOM-based XSS flaw in Adobe Experience Manager. Unlike reflected or stored XSS variants, DOM-based XSS occurs entirely within the browser when client-side JavaScript writes attacker-controlled data into the Document Object Model without proper sanitization. The vulnerable AEM code path processes untrusted input from sources such as document.location, document.URL, or window.name and passes it to a sink that executes or renders JavaScript.

The scope change indicated by the CVSS vector means executed script escapes the vulnerable component boundary and affects other resources under the victim's authenticated AEM session. An attacker with low privileges in AEM can craft a URL that, once visited by a higher-privileged user, executes JavaScript in that user's session context.

Root Cause

The root cause is improper neutralization of input during web page generation, classified under CWE-79. Client-side JavaScript in AEM writes user-supplied data to a dangerous DOM sink without applying context-appropriate encoding or sanitization. Common sinks include innerHTML, document.write(), eval(), and jQuery's $() selector when passed HTML strings.

Attack Vector

The attack vector is network-based and requires user interaction. An authenticated attacker with low privileges crafts a malicious URL containing a payload in a DOM source, such as the URL fragment. The attacker delivers this URL through phishing, chat, or a compromised page. When a victim clicks the link while authenticated to AEM, the vulnerable client-side script parses the fragment and injects the payload into the DOM, executing the attacker's JavaScript in the victim's browser.

No verified proof-of-concept code has been published. Refer to the Adobe Security Advisory APSB26-98 for vendor-provided technical details.

Detection Methods for CVE-2026-75670

Indicators of Compromise

Unusual outbound HTTP requests from authenticated AEM author or publish sessions to attacker-controlled domains.
AEM access logs showing requests with suspicious URL fragments or query parameters containing HTML tags, javascript: URIs, or encoded script payloads.
Unexpected content modifications, user account changes, or new administrator accounts created shortly after a user clicked an external link.
Browser console errors or Content Security Policy (CSP) violation reports originating from AEM author interfaces.

Detection Strategies

Deploy a Content Security Policy that reports violations, then monitor CSP report endpoints for inline script executions on AEM pages.
Enable and review AEM request logs for URIs containing patterns such as <script, onerror=, javascript:, or URL-encoded equivalents.
Correlate authentication events with anomalous session activity following a URL click, focusing on privileged AEM accounts.
Deploy web application firewall (WAF) rules that inspect query strings and fragments for common XSS payloads targeting AEM endpoints.

Monitoring Recommendations

Ingest AEM dispatcher, access, and audit logs into a centralized SIEM or data lake for correlation and long-term retention.
Alert on privilege escalation actions, content changes, or configuration modifications performed within seconds of a page navigation event.
Monitor endpoint telemetry from workstations used by AEM administrators for browser-based process anomalies and credential access attempts.

How to Mitigate CVE-2026-75670

Immediate Actions Required

Apply the security updates published in Adobe Security Advisory APSB26-98 to all affected AEM Cloud Service and AEM 6.5 LTS instances.
Audit AEM user accounts and remove unnecessary low-privileged accounts that could be used to craft internal attacks.
Instruct AEM administrators and content authors to avoid clicking unsolicited links to AEM URLs, particularly during the patch window.
Review recent AEM audit logs for suspicious content changes or account modifications made during authenticated sessions.

Patch Information

Adobe has released fixed versions for both AEM Cloud Service and AEM 6.5 LTS. Consult Adobe Security Advisory APSB26-98 for the specific fixed versions and update procedures for your deployment model.

Workarounds

Enforce a strict Content Security Policy on AEM author and publish instances that disallows inline scripts and restricts script sources to trusted origins.
Restrict access to AEM author interfaces to trusted networks or VPN-only access to reduce exposure to phishing-delivered exploit URLs.
Configure the AEM dispatcher to filter requests containing suspicious patterns such as HTML tags or javascript: schemes in query parameters and fragments.
Enable browser-level protections such as HttpOnly and Secure flags on session cookies to limit the impact of successful script execution.