CVE-2026-75672: Adobe Experience Manager XSS Vulnerability

CVE-2026-75672 Overview

CVE-2026-75672 is a DOM-based Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Adobe Experience Manager (AEM). An attacker can manipulate the client-side Document Object Model (DOM) to execute arbitrary JavaScript in a victim's browser session. Exploitation requires user interaction, specifically that the victim visits a crafted webpage. The scope is changed, meaning the vulnerable component impacts resources beyond its own security boundary. Adobe published details in security bulletin APSB26-98.

Critical Impact
Successful exploitation allows attackers to execute malicious JavaScript in the victim's browser context, potentially enabling session token theft, unauthorized actions within AEM, or redirection to attacker-controlled infrastructure.

Affected Products

Adobe Experience Manager Cloud Service (AEM Cloud Service)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS Service Packs 1 and 2

Discovery Timeline

2026-09-08 - CVE-2026-75672 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75672

Vulnerability Analysis

CVE-2026-75672 is a DOM-based XSS flaw in Adobe Experience Manager. Unlike reflected or stored XSS, DOM-based XSS occurs entirely in the client-side JavaScript, where untrusted input flows into a dangerous DOM sink without adequate sanitization. An attacker crafts a URL or webpage that manipulates DOM properties such as location, document.URL, or fragment identifiers. When a victim with valid AEM privileges visits the crafted page, the browser executes attacker-supplied JavaScript within the origin of the AEM application.

The scope-changed designation indicates that the injected script can affect resources beyond the vulnerable component itself. This raises the practical impact, because scripts executed in the AEM context may access authoring interfaces, content repositories, or authenticated sessions belonging to marketing and content teams. The attack requires low privileges and user interaction, which limits mass exploitation but remains viable against targeted authors and administrators.

Root Cause

The root cause is improper neutralization of input during web page generation on the client side. AEM JavaScript passes attacker-controlled data into a DOM sink without escaping or contextual encoding, allowing script execution when the DOM is rendered.

Attack Vector

Exploitation is remote over the network. An attacker delivers a crafted URL through phishing, a malicious link, or an embedded resource. The victim must be authenticated to AEM at low privilege and must interact by visiting the crafted page. Once executed, the payload runs with the victim's session context.

No public proof-of-concept exploit code has been released for CVE-2026-75672. Refer to the Adobe Security Advisory APSB26-98 for vendor-provided technical guidance.

Detection Methods for CVE-2026-75672

Indicators of Compromise

Unusual URL parameters, fragment identifiers, or query strings targeting AEM author and publish endpoints containing JavaScript keywords such as <script>, javascript:, or event handlers like onerror= and onload=.
Web server access logs showing repeated requests to AEM URLs from external referrers with encoded payloads in the fragment or query portion.
Browser console errors or unexpected outbound requests from AEM author sessions to unknown domains.

Detection Strategies

Deploy Content Security Policy (CSP) reporting to capture blocked inline script executions on AEM origins.
Inspect AEM Dispatcher and reverse proxy logs for URI patterns containing DOM manipulation payloads or long encoded strings in fragments.
Correlate authenticated AEM sessions with anomalous outbound network traffic that may indicate token exfiltration.

Monitoring Recommendations

Ingest AEM access logs, Dispatcher logs, and browser CSP reports into a centralized analytics pipeline for correlation.
Alert on AEM author accounts performing unexpected content modifications shortly after clicking external links.
Monitor for creation of new AEM users, permission changes, or package installations following user-interaction events.

How to Mitigate CVE-2026-75672

Immediate Actions Required

Apply the security updates referenced in Adobe Security Advisory APSB26-98 to all affected AEM Cloud Service and AEM 6.5 LTS deployments.
Inventory all AEM instances, including author, publish, and Dispatcher tiers, and confirm patch status.
Rotate session tokens and require re-authentication for AEM authors and administrators after patching.

Patch Information

Adobe has released fixes for Adobe Experience Manager Cloud Service and Adobe Experience Manager 6.5 LTS through Service Pack 2. Consult Adobe Security Advisory APSB26-98 for exact patched versions and download links.

Workarounds

Enforce a strict Content Security Policy on AEM origins that disallows inline scripts and untrusted script sources to reduce DOM XSS impact.
Restrict AEM author interface access to trusted networks or VPN-only connectivity, limiting reachability by external attackers.
Train content authors and administrators to avoid clicking untrusted links while authenticated to AEM.

bash

# Configuration example: baseline CSP header for AEM author instance
# Deploy at the Dispatcher or reverse proxy layer
Header always set Content-Security-Policy "default-src 'self'; \
  script-src 'self'; \
  object-src 'none'; \
  base-uri 'self'; \
  frame-ancestors 'self'; \
  report-uri /csp-report"