CVE-2026-75671: Adobe Experience Manager XSS Vulnerability

CVE-2026-75671 Overview

Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting (XSS) vulnerability [CWE-79] that allows an attacker to execute arbitrary JavaScript in a victim's browser. Exploitation requires user interaction, specifically that a victim visits a crafted webpage. The vulnerability has a changed scope, meaning code executed via the flaw can affect resources beyond the vulnerable component. Adobe published security advisory APSB26-98 addressing this issue across AEM Cloud Service and AEM 6.5 LTS releases. The flaw impacts confidentiality and integrity of user session data within the affected AEM context.

Critical Impact
An authenticated attacker with low privileges can execute JavaScript in a victim's browser session, potentially hijacking authenticated AEM sessions or performing actions on behalf of the user.

Affected Products

Adobe Experience Manager Cloud Service (aem_cloud_service)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS Service Packs SP1 and SP2

Discovery Timeline

2026-09-08 - CVE-2026-75671 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75671

Vulnerability Analysis

The vulnerability is a DOM-based XSS flaw in Adobe Experience Manager. DOM-based XSS occurs when client-side JavaScript writes attacker-controllable data into the Document Object Model (DOM) without proper sanitization or output encoding. Unlike reflected or stored XSS, the malicious payload is never sent to the server in a way that triggers server-side reflection. Instead, the injection occurs entirely within the browser as the vulnerable script processes attacker-influenced input, such as URL fragments, query parameters, or postMessage data.

Because AEM is widely deployed as a content management and digital experience platform, XSS in its administrative or authoring interfaces can lead to session compromise, unauthorized content publishing, or lateral movement into connected marketing and asset systems. The changed scope indicates the exploit can pivot from the vulnerable AEM component into a different security context.

Root Cause

The root cause is improper neutralization of input during web page generation on the client side [CWE-79]. Vulnerable JavaScript in AEM parses user-controlled input and passes it to a sink such as innerHTML, document.write, or eval without escaping. Adobe has not publicly disclosed the specific vulnerable component or code path.

Attack Vector

Exploitation requires an attacker with low privileges on the AEM instance and a victim who is tricked into visiting a crafted webpage. The attacker delivers a URL containing a malicious payload — typically encoded within the fragment identifier or query string — that is parsed by client-side AEM JavaScript. When executed, the payload runs in the origin of the AEM application, granting access to cookies, session storage, and DOM elements visible to authenticated users. See the Adobe Security Advisory APSB26-98 for vendor-provided technical details.

Detection Methods for CVE-2026-75671

Indicators of Compromise

Unusual outbound HTTP requests from AEM author or publish nodes to attacker-controlled domains, particularly containing session cookies or CSRF tokens.
Unexpected content modifications, page publications, or user account changes within AEM audit logs originating from legitimate user sessions.
HTTP access logs containing long, encoded strings in URL fragments or query parameters targeting AEM endpoints.

Detection Strategies

Deploy Content Security Policy (CSP) reporting to capture inline script violations that indicate attempted DOM-XSS execution.
Inspect AEM access logs for requests to authoring paths with suspicious URL parameters containing <script>, javascript:, or heavily URL-encoded payloads.
Correlate authenticated user activity with source IP anomalies to identify potential session hijacking following XSS exploitation.

Monitoring Recommendations

Enable and centralize AEM audit and access logs into a SIEM for real-time analysis of authoring and publishing actions.
Monitor browser-side telemetry from administrative endpoints for CSP violation reports and unexpected script execution.
Alert on new or unusual user-agent strings accessing AEM authoring endpoints, which may indicate automated exploitation attempts.

How to Mitigate CVE-2026-75671

Immediate Actions Required

Apply the patches referenced in the Adobe Security Advisory APSB26-98 to all AEM Cloud Service and AEM 6.5 LTS instances.
Audit AEM user accounts and remove or reduce privileges for accounts that do not require authoring access, limiting the pool of potential low-privilege attackers.
Rotate authentication tokens and session cookies for AEM users if exploitation is suspected.

Patch Information

Adobe released fixes as documented in advisory APSB26-98. Administrators of AEM Cloud Service should ensure their environment is on the latest release channel. Administrators of AEM 6.5 LTS with SP1 or SP2 must apply the vendor-provided update package described in the advisory.

Workarounds

Implement a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins, reducing the impact of DOM-based XSS.
Place a Web Application Firewall (WAF) in front of AEM authoring endpoints with rules blocking common XSS payload patterns in URL fragments and query parameters.
Restrict access to AEM authoring interfaces to trusted networks or VPN users until patches are applied.

bash

# Example CSP header to reduce DOM-XSS impact on AEM responses
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report