CVE-2026-75680: Adobe Experience Manager XSS Vulnerability

CVE-2026-75680 Overview

Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-75680. An attacker can manipulate the DOM environment to execute arbitrary JavaScript within the context of a victim's browser session. Exploitation requires user interaction: the target must visit a crafted webpage while authenticated to a vulnerable AEM instance. The scope is changed, meaning the impact extends beyond the initially vulnerable component. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation allows attackers to execute malicious JavaScript in the victim's browser, enabling session hijacking, credential theft, and unauthorized actions performed on behalf of the authenticated user.

Affected Products

Adobe Experience Manager Cloud Service (AEM CS)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS SP1 and SP2

Discovery Timeline

2026-09-08 - CVE-2026-75680 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75680

Vulnerability Analysis

The vulnerability resides in client-side JavaScript within Adobe Experience Manager that processes untrusted input from the DOM without proper sanitization. When a user visits an attacker-controlled URL or page containing crafted DOM parameters, the vulnerable script writes attacker-supplied data into a sink such as innerHTML, document.write, or eval. This results in execution of arbitrary JavaScript in the origin of the AEM application.

Because exploitation requires only low-privileged authenticated access and user interaction, an attacker can send a crafted link to an AEM author or content editor. Once opened, the payload runs with the victim's session privileges. The changed scope indicates the compromised script can affect resources beyond the initially vulnerable component, such as protected iframes or adjacent origins served by AEM.

Root Cause

The root cause is improper neutralization of user-controllable input flowing from a DOM source (for example, location.hash, location.search, or postMessage data) into a DOM sink that interprets input as HTML or JavaScript. AEM client libraries fail to encode or validate this input before rendering it in the page context.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a malicious URL pointing to a vulnerable AEM endpoint with a payload embedded in a DOM-accessible location. The victim, authenticated to AEM with low privileges, clicks the link. The vulnerable client-side script parses the payload and injects it into the DOM, triggering JavaScript execution in the AEM origin.

No verified proof-of-concept code is publicly available. Refer to the Adobe Security Advisory APSB26-98 for vendor-supplied technical context.

Detection Methods for CVE-2026-75680

Indicators of Compromise

Web server or reverse proxy logs showing AEM URLs containing suspicious JavaScript payloads in query strings, fragments, or referrer headers.
Unexpected outbound requests from authenticated author or content editor sessions to unfamiliar external domains.
AEM audit log entries reflecting unauthorized content modifications or privilege changes tied to a single user session shortly after visiting an external link.

Detection Strategies

Deploy a Content Security Policy (CSP) in report-only mode to surface script executions that violate expected origins and inline-script rules.
Inspect AEM access logs for URL patterns containing <script>, javascript:, onerror=, or encoded equivalents such as %3Cscript%3E.
Correlate browser telemetry from author workstations with AEM session activity to identify anomalous DOM manipulation events.

Monitoring Recommendations

Forward AEM dispatcher, publish, and author logs to a centralized SIEM for retention and query.
Monitor for high-frequency phishing indicators such as inbound emails to AEM administrators containing links to the AEM domain with encoded parameters.
Alert on privileged AEM user sessions originating from unusual geolocations or generating atypical API call volumes.

How to Mitigate CVE-2026-75680

Immediate Actions Required

Apply the security updates referenced in Adobe Security Advisory APSB26-98 to all affected AEM Cloud Service and AEM 6.5 LTS instances.
Restrict AEM author environment access to trusted networks using VPN or IP allowlisting.
Enforce security awareness for content authors regarding links received from untrusted senders.

Patch Information

Adobe has published fixes for Adobe Experience Manager Cloud Service and AEM 6.5 LTS (including SP1 and SP2) in Adobe Security Advisory APSB26-98. Administrators should confirm their deployed version matches or exceeds the patched release documented in the advisory.

Workarounds

Deploy a strict Content Security Policy that blocks inline scripts and restricts script sources to trusted origins.
Configure the AEM dispatcher to filter and reject requests containing suspicious script-injection patterns in URLs and headers.
Require multi-factor authentication for all AEM author accounts to limit the impact of session compromise.

bash

# Example CSP header restricting script execution in AEM dispatcher
Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-{RANDOM}'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"

# Example dispatcher filter rule to block common XSS payloads
/0100 { /type "deny" /url '*<script*' }
/0101 { /type "deny" /url '*javascript:*' }
/0102 { /type "deny" /url '*onerror=*' }