CVE-2026-75685: Adobe Experience Manager XSS Vulnerability

CVE-2026-75685 Overview

CVE-2026-75685 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM). An attacker can manipulate the Document Object Model (DOM) environment to execute arbitrary JavaScript in the context of the victim's browser. Exploitation requires low privileges on the AEM instance and user interaction, specifically that the victim visits a crafted webpage. The vulnerability carries a scope change, meaning successful exploitation can impact resources beyond the vulnerable component's authorization boundary. Adobe published patch guidance in advisory APSB26-98. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation enables execution of malicious JavaScript in a victim's browser session, exposing confidentiality and integrity of AEM-managed content and user sessions.

Affected Products

Adobe Experience Manager AEM Cloud Service
Adobe Experience Manager 6.5 LTS (base, SP1, SP2)
Adobe Experience Manager on-premise editions covered under advisory APSB26-98

Discovery Timeline

2026-09-08 - CVE-2026-75685 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75685

Vulnerability Analysis

The flaw is a client-side DOM-based XSS issue in Adobe Experience Manager. Unlike reflected or stored XSS, the malicious payload never needs to reach the server in an executable form. Instead, attacker-controlled data flows into a client-side sink such as document.write, innerHTML, or eval without adequate neutralization. When a victim loads a crafted URL or page that triggers the vulnerable JavaScript path, the payload executes under the AEM origin.

Because the vulnerability carries a scope change, injected script can reach data or components outside the vulnerable module's trust boundary. Attackers can leverage this to hijack authenticated AEM author or publish sessions, tamper with rendered content, or pivot to further application-level attacks. The vulnerability requires a low-privileged account on the AEM instance to stage the attack path.

Root Cause

The root cause is improper neutralization of user-controlled input written into DOM sinks by AEM's client-side scripts [CWE-79]. Data sourced from location, document.referrer, or postMessage is passed to sinks that interpret markup or JavaScript without sanitization or safe DOM APIs such as textContent or setAttribute with allow-listed values.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL or third-party page that, when loaded by an authenticated AEM user, drives the vulnerable client-side script to write attacker-controlled markup into the DOM. The injected script then runs in the AEM origin and inherits the victim's session privileges.

No verified proof-of-concept exploit code is publicly available for CVE-2026-75685. Refer to the Adobe Security Update APSB26-98 for vendor technical details.

Detection Methods for CVE-2026-75685

Indicators of Compromise

Unexpected outbound requests from authenticated AEM author or publish user browsers to attacker-controlled domains.
AEM access logs showing requests with suspicious URL fragments, encoded <script> payloads, or javascript: schemes in query parameters and fragments.
Unauthorized content modifications, new admin users, or configuration changes correlated with AEM author sessions.

Detection Strategies

Deploy a Content Security Policy (CSP) in report-only mode across AEM author and publish tiers and alert on violation reports referencing inline script or unsafe eval usage.
Monitor web application firewall (WAF) logs for URL fragments and query strings containing DOM-XSS payload primitives such as onerror=, javascript:, and <img src=x.
Correlate browser-side telemetry with AEM authentication logs to identify session anomalies tied to crafted external referrers.

Monitoring Recommendations

Enable and centrally ship AEM dispatcher and access logs to a SIEM for continuous review.
Track version and build metadata across AEM instances to confirm patch state against advisory APSB26-98.
Baseline normal referrer patterns for AEM author endpoints and alert on outliers pointing to external, low-reputation domains.

How to Mitigate CVE-2026-75685

Immediate Actions Required

Apply the Adobe fixes referenced in Adobe Security Bulletin APSB26-98 to all affected AEM Cloud Service and AEM 6.5 LTS instances.
Inventory low-privileged AEM accounts and enforce least privilege, removing unused author accounts that could be leveraged in the attack chain.
Instruct AEM authors and administrators to avoid clicking untrusted links while authenticated to AEM environments.

Patch Information

Adobe has released updates for Adobe Experience Manager Cloud Service and Adobe Experience Manager 6.5 LTS. Administrators should consult Adobe Security Update APSB26-98 for the specific fixed versions and upgrade guidance applicable to their deployment topology.

Workarounds

Enforce a strict Content Security Policy on AEM author and publish tiers to block inline script and untrusted script sources.
Configure the AEM dispatcher to filter or reject requests containing suspicious fragments and script payload markers.
Restrict AEM author interfaces to trusted networks or VPN, reducing exposure of authenticated sessions to attacker-controlled pages.

bash

# Example dispatcher filter to drop requests with script-like query parameters
/0100 { /type "deny" /url '*<script*' }
/0101 { /type "deny" /url '*javascript:*' }
/0102 { /type "deny" /url '*onerror=*' }