CVE-2026-75694: Adobe Experience Manager XSS Vulnerability

CVE-2026-75694 Overview

Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-75694. An attacker can manipulate the Document Object Model (DOM) environment to execute arbitrary JavaScript in the context of the victim's browser. Exploitation requires an authenticated attacker to lure a user into visiting a crafted webpage. The vulnerability results in a scope change, meaning the impact extends beyond the vulnerable component to other browser-trusted contexts. Adobe published a security advisory addressing the issue in both AEM on-premises and AEM Cloud Service deployments.

Critical Impact
Successful exploitation allows arbitrary JavaScript execution in a victim's browser session, enabling session token theft, unauthorized actions within AEM, and phishing pivots against authenticated users.

Affected Products

Adobe Experience Manager (AEM) Cloud Service
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS Service Packs 1 and 2

Discovery Timeline

2026-09-08 - CVE-2026-75694 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75694

Vulnerability Analysis

CVE-2026-75694 is a DOM-based Cross-Site Scripting (XSS) issue classified under [CWE-79]: Improper Neutralization of Input During Web Page Generation. The flaw resides in client-side JavaScript executed by AEM, where attacker-controlled data reaches a DOM sink such as innerHTML, document.write, or eval without proper sanitization. Unlike reflected or stored XSS, the malicious payload never needs to traverse the server, complicating server-side detection. The scope change reflected in the CVSS vector indicates that code executing in the victim's browser can affect resources outside the vulnerable component's security authority, such as sibling AEM applications sharing the same origin trust boundary.

Root Cause

The root cause is insufficient neutralization of untrusted input processed by client-side scripts within Adobe Experience Manager. When a victim loads a crafted URL, page fragment, or hash value, client-side code writes attacker-controlled strings directly into an executable DOM context. Because the transformation occurs entirely in the browser, framework-level output escaping does not apply.

Attack Vector

Exploitation requires the attacker to hold low-privileged credentials on the target AEM instance and to convince an authenticated user to visit a specially crafted webpage. Once loaded, the malicious script executes with the victim's privileges in AEM. Attackers commonly use this primitive to steal session cookies, submit CSRF requests, perform content modifications, or stage credential harvesting overlays inside the trusted AEM UI.

No public proof-of-concept exploit or exploitation-in-the-wild has been reported. Refer to the Adobe Security Advisory APSB26-98 for vendor-provided technical details.

Detection Methods for CVE-2026-75694

Indicators of Compromise

Web server or CDN logs showing crafted requests to AEM pages containing script fragments in URL fragments, query parameters, or hash values (e.g., #<img src=x onerror=...>).
Content Security Policy (CSP) violation reports referencing inline script execution or unexpected script sources on AEM pages.
Anomalous AEM author or publish activity originating from legitimate user sessions shortly after those users visited external links.

Detection Strategies

Deploy a strict Content Security Policy on AEM author and publish tiers and forward report-uri events to a centralized log store for review.
Add web application firewall (WAF) rules that inspect request URIs and fragments for common DOM-XSS payloads targeting AEM component paths.
Correlate browser telemetry from managed endpoints with AEM session activity to identify JavaScript execution originating from attacker-controlled domains.

Monitoring Recommendations

Monitor AEM access.log and dispatcher logs for repeated requests to the same page with unusual fragment identifiers or encoded script content.
Alert on authenticated AEM sessions performing bulk content changes, permission modifications, or user creation shortly after off-domain referrers.
Track outbound requests from AEM author users to newly registered or low-reputation domains that may host XSS delivery pages.

How to Mitigate CVE-2026-75694

Immediate Actions Required

Apply the security updates listed in Adobe Security Advisory APSB26-98 to all affected AEM on-premises and Cloud Service instances.
Audit AEM user accounts and revoke unnecessary author-tier privileges, since exploitation requires a low-privileged authenticated attacker.
Rotate active AEM session tokens and administrative credentials if suspicious activity is identified during triage.

Patch Information

Adobe released fixed builds for Adobe Experience Manager 6.5 LTS and pushed corresponding updates to AEM as a Cloud Service. Consult Adobe Security Advisory APSB26-98 for the specific fixed versions, service pack levels, and Cloud Service release identifiers that remediate CVE-2026-75694.

Workarounds

Enforce a restrictive Content Security Policy that blocks inline scripts and limits script sources to trusted origins on AEM author and publish tiers.
Restrict AEM author instance access to trusted networks or VPN-only reachability to reduce exposure of low-privileged accounts.
Provide security awareness guidance to AEM users so they recognize and avoid suspicious links referencing internal AEM URLs.

bash

# Example dispatcher filter to block suspicious script-like fragments
# Add to /etc/httpd/conf.d/dispatcher.conf filter section
/0100 { /type "deny" /url '*<script*' }
/0101 { /type "deny" /url '*javascript:*' }
/0102 { /type "deny" /url '*onerror=*' }