CVE-2026-75691: Adobe Experience Manager XSS Vulnerability

CVE-2026-75691 Overview

CVE-2026-75691 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM). An attacker can manipulate the Document Object Model (DOM) environment to execute arbitrary JavaScript in the victim's browser context. Exploitation requires user interaction, specifically visiting a crafted webpage. The vulnerability has a changed scope, allowing impact beyond the vulnerable component. The flaw is categorized under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
An authenticated attacker with low privileges can execute malicious JavaScript in a victim's browser session, potentially leading to session data disclosure and limited integrity impact on the affected AEM application.

Affected Products

Adobe Experience Manager AEM Cloud Service
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS SP1 and SP2

Discovery Timeline

2026-09-08 - CVE-2026-75691 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75691

Vulnerability Analysis

The vulnerability resides in client-side JavaScript logic within Adobe Experience Manager. AEM processes attacker-controlled input from the DOM without proper sanitization or output encoding. Because the flaw is DOM-based, malicious payloads are never sent to the server, evading server-side detection controls. The changed scope indicator reflects that successful exploitation impacts resources beyond the vulnerable component, such as parent frames or federated authentication contexts.

Exploitation delivers script execution under the origin of the AEM application. This enables theft of session tokens, manipulation of authoring content, and pivoting into administrative workflows accessible to the victim. The confidentiality and integrity impacts are limited because payloads execute within the victim's browser session rather than on the AEM server itself.

Root Cause

The root cause is improper neutralization of user-controllable input reflected into a DOM sink such as innerHTML, document.write, or eval. Client-side scripts consume attacker-influenced values, including URL fragments, query parameters, or postMessage data, and write them into an execution context without sanitization. Adobe's advisory APSB26-98 identifies the specific affected components.

Attack Vector

The attack vector is network-based and requires an authenticated user with low privileges to visit a crafted URL. The attacker constructs a link containing a malicious payload in a location parsed by vulnerable client-side script. When the victim loads the page, the script writes the payload into a DOM sink, triggering JavaScript execution. Typical delivery mechanisms include phishing emails, malicious redirects, or embedded links inside trusted third-party content.

See the Adobe Security Advisory APSB26-98 for component-level technical details.

Detection Methods for CVE-2026-75691

Indicators of Compromise

Unusual URL patterns targeting AEM authoring endpoints containing script fragments, encoded angle brackets, or javascript: schemes in query strings or URL fragments.
Browser telemetry showing script execution originating from unexpected DOM sinks on AEM domains.
Web proxy or WAF logs recording requests with fragment identifiers containing base64-encoded JavaScript payloads.

Detection Strategies

Deploy Content Security Policy (CSP) reporting to capture and alert on inline script violations originating from AEM origins.
Correlate authenticated AEM session activity with outbound requests to attacker-controlled domains that could indicate token exfiltration.
Review AEM access logs for authoring users visiting externally referred URLs containing suspicious query or fragment parameters.

Monitoring Recommendations

Monitor endpoint EDR telemetry for browser processes making anomalous network connections following AEM authentication events.
Enable audit logging on AEM administrative actions and alert on privileged operations performed shortly after suspicious page loads.
Track user-agent and referrer anomalies in AEM access logs to identify potential phishing-driven exploitation.

How to Mitigate CVE-2026-75691

Immediate Actions Required

Apply the security updates referenced in Adobe Security Advisory APSB26-98 to all affected AEM Cloud Service and AEM 6.5 LTS instances.
Restrict AEM authoring interface access to trusted networks and VPN-only reachability where operationally feasible.
Enforce a strict Content Security Policy that disallows inline script execution and unsafe-eval on AEM domains.

Patch Information

Adobe has released security updates addressing CVE-2026-75691. Refer to the Adobe Security Advisory APSB26-98 for the specific fixed versions and update guidance for AEM Cloud Service and AEM 6.5 LTS SP1/SP2 deployments.

Workarounds

Deploy a Web Application Firewall (WAF) rule set to block requests containing script tags, javascript: schemes, or common XSS payload signatures in query strings and fragments targeting AEM endpoints.
Train content authors and administrators to avoid clicking untrusted links while authenticated to AEM authoring environments.
Configure browser isolation for AEM administrative users to contain script execution within an isolated remote session.

bash

# Example CSP header to restrict inline script execution on AEM origins
Content-Security-Policy: default-src 'self'; \
  script-src 'self' 'nonce-{RANDOM}'; \
  object-src 'none'; \
  base-uri 'self'; \
  frame-ancestors 'self'; \
  report-uri /csp-report-endpoint