CVE-2026-75674: Adobe Experience Manager XSS Vulnerability

CVE-2026-75674 Overview

Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-75674. An attacker can manipulate the Document Object Model (DOM) environment to execute malicious JavaScript in the victim's browser context. Exploitation requires user interaction: the victim must visit a crafted webpage while authenticated to a low-privileged AEM session. The vulnerability results in a scope change, meaning executed script can affect resources beyond the vulnerable component. The flaw is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation enables execution of attacker-controlled JavaScript within an authenticated AEM user's browser, leading to session compromise, content manipulation, or pivoting into administrative workflows.

Affected Products

Adobe Experience Manager (AEM) Cloud Service
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS Service Packs SP1 and SP2

Discovery Timeline

2026-09-08 - CVE-2026-75674 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75674

Vulnerability Analysis

The vulnerability is a client-side DOM-based XSS flaw in Adobe Experience Manager. Unlike reflected or stored XSS, the injection occurs entirely within the browser as client-side JavaScript writes attacker-controlled data into a DOM sink without proper neutralization. The scope change indicates the executed script can influence security-relevant resources outside the vulnerable component's authority, such as parent frames, other AEM authoring surfaces, or session-bound tokens. An authenticated low-privileged user visiting a crafted page can trigger execution that impacts higher-value resources. Confidentiality and integrity are affected at a limited level; availability is not impacted.

Root Cause

The root cause is improper neutralization of untrusted input passed to a DOM sink in AEM's client-side JavaScript ([CWE-79]). Data sourced from a controllable location, such as a URL fragment, query parameter, or postMessage payload, reaches an execution sink like innerHTML, document.write, or an event handler assignment without contextual encoding. Because sanitization occurs after the data is already interpreted as script, the browser renders and executes attacker-supplied markup.

Attack Vector

Exploitation follows a network-based, user-interactive pattern. The attacker crafts a malicious URL or webpage embedding a payload that AEM's client-side scripts insert into the DOM. When an authenticated AEM user visits the crafted page or clicks the link, the payload executes in the origin of the AEM application. Because the scope changes, the resulting script can act against components beyond the initial vulnerable surface, including author instances and administrative workflows. Refer to the Adobe Security Bulletin APSB26-98 for vendor-provided technical details.

Detection Methods for CVE-2026-75674

Indicators of Compromise

Web server or CDN logs showing AEM URLs with unusual URL fragments, encoded HTML tags, or javascript: schemes in query parameters.
Content Security Policy (CSP) violation reports referencing inline script execution on AEM author or publish origins.
Unexpected outbound requests from authenticated author sessions to attacker-controlled domains carrying cookies, tokens, or form data.
Newly created or modified AEM users, pages, or assets that correlate with an authenticated session recently exposed to a suspicious external link.

Detection Strategies

Inspect browser telemetry and endpoint EDR data for JavaScript execution originating from AEM domains that spawns credential-harvesting or exfiltration traffic.
Deploy a strict CSP with report-uri on AEM author and publish tiers to identify inline script attempts and violations tied to CVE-2026-75674 exploitation patterns.
Correlate access logs of AEM authoring endpoints with referer headers pointing to unknown external hosts, particularly for low-privileged accounts.

Monitoring Recommendations

Enable WAF rules that inspect query strings, URL fragments, and postMessage-related parameters for HTML tags, event handlers (onerror=, onload=), and script scheme prefixes.
Monitor administrative changes in AEM audit logs performed shortly after a user clicked an external link, indicating potential session abuse.
Track anomalous privilege changes, package installations, or replication actions in AEM performed from atypical IP addresses or user agents.

How to Mitigate CVE-2026-75674

Immediate Actions Required

Apply the updates referenced in Adobe Security Bulletin APSB26-98 to all AEM Cloud Service and AEM 6.5 LTS instances, including SP1 and SP2.
Invalidate active authoring sessions after patching to force re-authentication of users who may have been exposed.
Restrict access to AEM author instances to trusted networks or VPN-protected segments to reduce the attack surface for user-interactive exploitation.
Review recent AEM audit logs for suspicious content changes, user creations, or replication activity that may indicate prior exploitation.

Patch Information

Adobe released fixes for CVE-2026-75674 in the updates listed in Adobe Security Bulletin APSB26-98. AEM Cloud Service customers receive updates automatically through Adobe's release pipeline. AEM 6.5 LTS customers must apply the corresponding service pack or hotfix documented in the bulletin. Confirm the deployed build version against the fixed version numbers published by Adobe before closing the remediation ticket.

Workarounds

Enforce a strict Content Security Policy on AEM author and publish tiers that disallows inline scripts and restricts script sources to trusted origins.
Configure Dispatcher and upstream WAF rules to block requests containing raw HTML tags, event handler attributes, or javascript: URIs in query parameters and fragments.
Educate content authors and administrators to avoid clicking untrusted external links while authenticated to AEM, since exploitation requires user interaction.

bash

# Example CSP header for AEM Dispatcher (Apache) to reduce DOM XSS impact
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report"