CVE-2026-75675: Adobe Experience Manager XSS Vulnerability

CVE-2026-75675 Overview

Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-75675. An attacker can manipulate the Document Object Model (DOM) to execute arbitrary JavaScript within the victim's browser session. Exploitation requires user interaction: the victim must visit a crafted webpage. The vulnerability has a changed scope, meaning code execution can affect resources beyond the vulnerable component. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation allows attackers to execute malicious JavaScript in the victim's browser, potentially leading to session hijacking, credential theft, or unauthorized actions within the AEM environment.

Affected Products

Adobe Experience Manager Cloud Service (AEM CS)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS SP1 and SP2

Discovery Timeline

2026-09-08 - CVE-2026-75675 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75675

Vulnerability Analysis

CVE-2026-75675 is a DOM-based XSS flaw in Adobe Experience Manager. Unlike reflected or stored XSS, DOM-based XSS executes entirely client-side. The vulnerable JavaScript reads attacker-controlled data from the DOM and writes it back into a sink such as innerHTML, document.write, or eval without proper sanitization.

Attackers craft a URL containing malicious payload data, typically in the URL fragment or query string. When the victim loads the page, client-side scripts process the untrusted input and inject it into the executing document context. The changed scope indicates that injected script can pivot into contexts beyond the initially vulnerable component, expanding the impact surface.

Successful exploitation requires an authenticated session with low privileges. Attackers can steal AEM author or admin session tokens, modify content, or perform CSRF-style actions against the AEM instance under the victim's identity.

Root Cause

The root cause is improper neutralization of user-controlled input during client-side DOM manipulation in AEM JavaScript components. The application trusts data derived from browser-controlled sources such as location.hash, location.search, or document.referrer and passes it to a dangerous sink without encoding or validation.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts or shares a crafted URL pointing to a vulnerable AEM endpoint. When an authenticated AEM user clicks the link, the malicious payload executes in their browser under the AEM origin. See the Adobe Security Advisory APSB26-98 for vendor technical details.

// Illustrative DOM-based XSS pattern (conceptual)
// Vulnerable pattern: unsanitized DOM source flowing to dangerous sink
// var payload = location.hash.substring(1);
// document.getElementById('target').innerHTML = payload;
//
// See Adobe Security Advisory APSB26-98 for authoritative technical details.

Detection Methods for CVE-2026-75675

Indicators of Compromise

Anomalous AEM URLs containing encoded JavaScript payloads in query strings or fragments (javascript:, <script>, onerror=, onload=)
Unexpected outbound requests from authenticated author/admin browser sessions to attacker-controlled domains
AEM audit log entries showing content modifications by users who did not initiate the actions
Unexplained session token reuse from geographically or behaviorally inconsistent sources

Detection Strategies

Inspect web server and proxy logs for AEM request URIs containing XSS payload signatures such as script tags, event handlers, or data: URIs
Deploy Content Security Policy (CSP) reporting endpoints to capture blocked inline script executions from the AEM origin
Correlate authenticated AEM sessions with abnormal JavaScript execution telemetry from endpoint browsers

Monitoring Recommendations

Monitor AEM Dispatcher and reverse proxy logs for suspicious URL fragments and encoded payloads targeting known DOM sinks
Enable CSP violation reporting on AEM author instances to surface injected script attempts
Alert on user actions in AEM that deviate from baseline behavior for content authors and administrators

How to Mitigate CVE-2026-75675

Immediate Actions Required

Apply the Adobe security update referenced in APSB26-98 to all affected AEM Cloud Service, 6.5 LTS, SP1, and SP2 instances
Restrict AEM author interface access to trusted networks and VPN-only segments where feasible
Enforce short session lifetimes and require re-authentication for privileged operations
Educate AEM authors and administrators to avoid clicking untrusted links while authenticated

Patch Information

Adobe has released patches addressing CVE-2026-75675 across affected AEM versions. Refer to the Adobe Security Advisory APSB26-98 for the specific fixed versions and update procedures for AEM Cloud Service and AEM 6.5 LTS branches.

Workarounds

Deploy a strict Content Security Policy (CSP) on AEM author instances to block inline script execution and untrusted script sources
Configure AEM Dispatcher rules to filter request parameters containing common XSS payload signatures
Restrict AEM author console access via IP allowlisting or VPN until patching is complete

bash

# Example CSP header for AEM author instance (Apache/Dispatcher)
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report"

# Example Dispatcher filter to block suspicious query strings
/0100 { /type "deny" /url "*<script*" }
/0101 { /type "deny" /url "*javascript:*" }
/0102 { /type "deny" /url "*onerror=*" }