CVE-2026-75679: Adobe Experience Manager XSS Vulnerability

CVE-2026-75679 Overview

CVE-2026-75679 is a DOM-based Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Adobe Experience Manager (AEM). An attacker can manipulate the Document Object Model (DOM) environment in the victim's browser to execute arbitrary JavaScript within the AEM application context. Exploitation requires low-privileged authentication and user interaction, specifically the victim visiting a crafted webpage. The scope is changed, meaning successful exploitation impacts resources beyond the vulnerable component's security authority. Adobe published security advisory APSB26-98 covering this issue across AEM Cloud Service and AEM 6.5 LTS releases.

Critical Impact
Successful exploitation allows attacker-controlled JavaScript to run in the victim's browser session, enabling session token theft, unauthorized actions on behalf of authenticated AEM users, and potential pivot into content authoring workflows.

Affected Products

Adobe Experience Manager Cloud Service (AEM as a Cloud Service)
Adobe Experience Manager 6.5 LTS (base, SP1, SP2)
Adobe Experience Manager (all supported on-premise releases prior to the APSB26-98 fix)

Discovery Timeline

2026-09-08 - CVE-2026-75679 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75679

Vulnerability Analysis

The vulnerability resides in client-side JavaScript executed by Adobe Experience Manager. AEM processes attacker-controlled input from a DOM source, such as location.hash, location.search, or document.referrer, and passes it into a dangerous sink without proper sanitization or encoding. Common sinks include innerHTML, document.write, or eval. Because the flaw executes entirely in the browser, the payload never reaches server-side filters, making traditional web application firewall (WAF) rules that inspect request bodies less effective.

The attack requires the victim to be authenticated to AEM and to visit a crafted URL. The changed scope in the vulnerability metadata reflects that injected script executes with the trust and origin of the AEM application, potentially reaching content, assets, and administrative interfaces the victim can access.

Root Cause

The root cause is improper neutralization of input during web page generation on the client side [CWE-79]. AEM front-end code reads a DOM property influenced by URL parameters and writes it into an HTML rendering sink without contextual output encoding. Adobe has not published the specific affected component in the public advisory beyond identifying it as a DOM-based XSS in the Adobe Security Advisory APSB26-98.

Attack Vector

An attacker crafts a URL pointing to a legitimate AEM instance and embeds a malicious payload in a fragment or query parameter. The attacker then delivers the URL through phishing, malvertising, or a compromised third-party site. When an authenticated AEM user clicks the link, the browser loads the AEM page, vulnerable client-side script parses the tainted DOM source, and the payload is written into a sink where it executes. The attacker inherits the victim's AEM session and can issue authenticated requests, exfiltrate content, or modify authoring artifacts within the victim's permissions.

No public proof-of-concept exploit is available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-75679

Indicators of Compromise

Inbound requests to AEM URLs containing suspicious fragments or query parameters carrying HTML tags, javascript: URIs, or encoded <script> payloads.
Unexpected outbound requests from authenticated AEM author or publish sessions to attacker-controlled domains carrying session cookies or CSRF tokens.
Referrer headers pointing to unknown third-party domains immediately preceding privileged AEM actions.

Detection Strategies

Deploy Content Security Policy (CSP) reporting to capture inline script violations and unexpected script-src sources on AEM pages.
Instrument browser telemetry or Real User Monitoring to alert on DOM sinks receiving untrusted DOM source data.
Correlate web access logs with authentication logs to identify sessions that follow suspicious inbound referrers.

Monitoring Recommendations

Monitor AEM author instance access logs for anomalous query strings and URI fragments containing script keywords or URL-encoded angle brackets.
Enable audit logging for content modifications and account changes performed by AEM author accounts, and alert on activity outside normal working windows.
Track privileged AEM session activity for unexpected API calls to /bin/, /libs/, or /crx/ paths originating shortly after a page load with an external referrer.

How to Mitigate CVE-2026-75679

Immediate Actions Required

Apply the updates listed in the Adobe Security Advisory APSB26-98 to all AEM Cloud Service and AEM 6.5 LTS environments.
Restrict AEM author instance access to trusted networks or VPN-only routes to limit exposure of authenticated users to arbitrary external links.
Educate content authors and administrators about phishing links that target AEM URLs.

Patch Information

Adobe released fixed builds for Adobe Experience Manager as part of the September 2026 security update cycle. Refer to the Adobe Security Advisory APSB26-98 for exact version numbers, download links, and applicability by deployment model. AEM as a Cloud Service customers receive the fix through the standard Adobe managed release channel.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script-src to trusted origins on AEM author and publish tiers.
Configure the AEM Dispatcher to filter query parameters and URI fragments containing HTML metacharacters before proxying to publish instances.
Require re-authentication for sensitive AEM operations to reduce the value of a hijacked session token.

bash

# Example AEM Dispatcher filter rule to drop suspicious query strings
/0100 { /type "deny" /url '*<script*' }
/0101 { /type "deny" /url '*javascript:*' }
/0102 { /type "deny" /url '*%3Cscript*' }