CVE-2026-75687: Adobe Experience Manager XSS Vulnerability

CVE-2026-75687 Overview

CVE-2026-75687 is a DOM-based Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Adobe Experience Manager (AEM). An attacker can manipulate the client-side Document Object Model (DOM) environment to execute malicious JavaScript within the victim's browser session. Exploitation requires user interaction: the victim must visit a crafted webpage. The vulnerability carries a changed scope, meaning the impact extends beyond the vulnerable component into other security contexts. Adobe published fixes in advisory APSB26-98.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser, potentially leading to session compromise, credential theft, or unauthorized actions performed under the victim's identity within AEM.

Affected Products

Adobe Experience Manager (AEM Cloud Service)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS SP1 and SP2

Discovery Timeline

2026-09-08 - CVE-2026-75687 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75687

Vulnerability Analysis

The vulnerability resides in client-side JavaScript that processes untrusted input from the DOM without proper sanitization or output encoding. An attacker crafts a URL or webpage that manipulates DOM sources such as document.location, document.URL, or document.referrer. When this data flows into a sink such as innerHTML, document.write, or eval, the injected script executes in the victim's browser under the AEM origin.

Because the CVSS scope is changed, the injected script can affect resources beyond the vulnerable component's security authority. Exploitation requires low privileges (an authenticated context) and user interaction. The attack executes over the network, making phishing and social engineering practical delivery mechanisms.

Root Cause

The root cause is improper neutralization of input during web page generation on the client side. Adobe Experience Manager fails to validate or encode untrusted DOM data before passing it to a browser execution sink, allowing script injection at the DOM layer rather than at the server layer.

Attack Vector

An attacker crafts a malicious URL containing script payloads in DOM-accessible parameters such as the URL fragment or query string. The attacker then delivers this URL to an authenticated AEM user via phishing, chat, or a compromised third-party page. When the victim loads the crafted URL, vulnerable client-side code reads the attacker-controlled input and writes it into an executable sink. The browser then executes the payload under the AEM domain, granting the attacker access to session cookies, CSRF tokens, and authenticated AEM functionality. Refer to the Adobe Security Advisory APSB26-98 for vendor technical details.

Detection Methods for CVE-2026-75687

Indicators of Compromise

Web server or Content Delivery Network (CDN) logs containing requests with suspicious JavaScript payloads in URL fragments, query parameters, or Referer headers targeting AEM endpoints.
Unexpected outbound requests from authenticated AEM user sessions to attacker-controlled domains, indicative of session token exfiltration.
AEM audit log entries showing privileged actions performed from anomalous client contexts or in rapid succession after a user visited an external link.

Detection Strategies

Deploy Content Security Policy (CSP) reporting to capture inline script violations and unexpected script sources loaded within the AEM origin.
Inspect HTTP request patterns for common DOM XSS payload signatures such as javascript:, <script>, onerror=, and encoded variants in fragments and query strings.
Correlate authentication events with subsequent DOM manipulation or unusual API calls originating from the same browser session.

Monitoring Recommendations

Enable verbose logging on AEM Dispatcher and upstream Web Application Firewall (WAF) to preserve full request URIs including fragments where the reverse proxy supports it.
Monitor Adobe Experience Manager Cloud Service change feeds and administrative activity for unauthorized content modifications following user visits to external URLs.
Alert on CSP violation reports referencing AEM authoring or publish domains as the document origin.

How to Mitigate CVE-2026-75687

Immediate Actions Required

Apply the security updates listed in Adobe Security Advisory APSB26-98 to all affected AEM Cloud Service and AEM 6.5 LTS deployments.
Audit authenticated AEM user accounts for suspicious activity between the vulnerability publication date and patch deployment.
Rotate session cookies and force reauthentication for administrative and author accounts after patching.

Patch Information

Adobe released fixes for CVE-2026-75687 in security bulletin APSB26-98. Customers running AEM Cloud Service should ensure their environment is upgraded to the latest release. Customers running AEM 6.5 LTS should apply the corresponding service pack update as documented in the advisory. Consult the Adobe Security Advisory APSB26-98 for exact fixed version numbers.

Workarounds

Enforce a strict Content Security Policy (CSP) on AEM author and publish instances to block inline scripts and unauthorized script sources.
Configure the AEM Dispatcher and upstream WAF to filter requests containing common XSS payload patterns in query strings and fragments.
Restrict authoring access to trusted networks via IP allowlisting until patches are applied, reducing the population of users an attacker can target.

bash

# Example Dispatcher filter rule to block common XSS payloads in query strings
/0100 { /type "deny" /url '.*(<script|javascript:|onerror=|onload=).*' }