CVE-2026-75690: Adobe Experience Manager XSS Vulnerability

CVE-2026-75690 Overview

CVE-2026-75690 is a DOM-based Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Adobe Experience Manager (AEM). An attacker can manipulate the Document Object Model (DOM) environment to execute malicious JavaScript inside a victim's browser session. Exploitation requires user interaction, specifically the victim visiting a crafted webpage, and the vulnerability results in a scope change per the CVSS vector. The issue affects Adobe Experience Manager Cloud Service and multiple 6.5 Long-Term Support (LTS) service pack releases. Adobe addressed the vulnerability in Security Advisory APSB26-98.

Critical Impact
Successful exploitation lets an attacker execute arbitrary JavaScript in the victim's browser context, enabling session theft, unauthorized actions in AEM, and content manipulation within the authenticated user's scope.

Affected Products

Adobe Experience Manager Cloud Service (AEM as a Cloud Service)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS Service Pack 1 and Service Pack 2

Discovery Timeline

2026-09-08 - CVE-2026-75690 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75690

Vulnerability Analysis

CVE-2026-75690 is a client-side DOM-based XSS flaw in Adobe Experience Manager. Unlike reflected or stored XSS, DOM-based XSS executes entirely in the browser when client-side JavaScript writes attacker-controlled data into a sensitive DOM sink without proper sanitization. The vulnerability exhibits a scope change, meaning code executing in the vulnerable AEM component can affect resources beyond the component's own security authority. Exploitation requires an authenticated user with low privileges to interact with a crafted webpage or URL. Because AEM is used to author, manage, and publish enterprise web content, XSS execution in an authoring context can influence downstream published pages and user sessions.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79] within client-side JavaScript handling. Attacker-controlled data flows from a DOM source such as location.hash, location.search, or document.referrer into a dangerous sink such as innerHTML, document.write, or eval without contextual output encoding. Adobe has not publicly disclosed the specific vulnerable component or script path.

Attack Vector

The attack requires network access, low privileges, and user interaction. An attacker crafts a malicious URL or webpage containing a payload targeting the vulnerable DOM sink in AEM. When an authenticated AEM user visits the crafted page or clicks a specially formed link, the client-side script processes the payload and executes attacker-supplied JavaScript within the AEM origin. The attacker can then read session tokens accessible to script, perform actions on behalf of the user, or modify rendered content. No public proof-of-concept exploit code is available at the time of publication.

Detection Methods for CVE-2026-75690

Indicators of Compromise

Unusual HTTP requests to AEM containing encoded JavaScript payloads in URL fragments, query parameters, or referrer headers.
Content Security Policy (CSP) violation reports originating from AEM author or publish instances involving inline script execution.
Unexpected session activity, content modifications, or API calls performed under legitimate AEM user accounts shortly after clicking external links.

Detection Strategies

Deploy a web application firewall (WAF) rule set that inspects requests to AEM endpoints for XSS payload patterns such as <script>, javascript:, and event handler attributes.
Enable and monitor a strict Content Security Policy on AEM instances to block inline script execution and report violations to a central logging system.
Correlate browser telemetry and endpoint logs to identify unexpected script execution or outbound connections originating from AEM author sessions.

Monitoring Recommendations

Ingest AEM dispatcher, author, and publish access logs into a centralized analytics platform and alert on anomalous URL parameter patterns.
Track authenticated user actions in AEM for unexpected content edits, workflow submissions, or permission changes that follow inbound link clicks.
Monitor CSP violation endpoints and browser error telemetry for spikes correlating with AEM URLs.

How to Mitigate CVE-2026-75690

Immediate Actions Required

Apply the updates listed in Adobe Security Advisory APSB26-98 to all affected AEM Cloud Service and 6.5 LTS instances.
Restrict AEM author instance access to trusted networks and authenticated users through VPN or IP allowlisting.
Educate content authors and administrators to avoid clicking untrusted links while authenticated to AEM.

Patch Information

Adobe released fixed builds for Adobe Experience Manager Cloud Service and Adobe Experience Manager 6.5 LTS Service Pack releases. Administrators should consult Adobe Security Advisory APSB26-98 for the exact fixed versions and upgrade procedures. AEM as a Cloud Service customers receive updates through Adobe's managed release channel.

Workarounds

Enforce a strict Content Security Policy on AEM instances that disallows unsafe-inline scripts and restricts script sources to trusted origins.
Configure the AEM dispatcher to filter suspicious query parameters, URL fragments, and characters commonly used in XSS payloads.
Enable HttpOnly and Secure flags on AEM session cookies to reduce the impact of script-accessible token theft.

bash

# Example AEM dispatcher filter to block common XSS characters in query strings
/0100 { /type "deny" /url "*<script*" }
/0101 { /type "deny" /url "*javascript:*" }
/0102 { /type "deny" /url "*onerror=*" }
/0103 { /type "deny" /url "*onload=*" }