CVE-2026-75695: Adobe Experience Manager XSS Vulnerability

CVE-2026-75695 Overview

Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-75695. An attacker can manipulate the Document Object Model (DOM) environment in the browser to execute arbitrary JavaScript within the victim's session context. Exploitation requires a low-privileged authenticated attacker and user interaction, specifically the victim visiting a crafted webpage. The vulnerability has a changed scope, meaning impact extends beyond the vulnerable component. The flaw affects both Adobe Experience Manager Cloud Service and AEM 6.5 LTS releases through Service Pack 2. The vulnerability maps to CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows execution of malicious JavaScript in the victim's browser, enabling session data theft, unauthorized actions in AEM, and pivoting into adjacent trust boundaries due to the changed scope.

Affected Products

Adobe Experience Manager Cloud Service (AEM CS)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS Service Pack 1 and Service Pack 2

Discovery Timeline

2026-09-08 - CVE-2026-75695 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75695

Vulnerability Analysis

The vulnerability is a client-side DOM-based XSS flaw in Adobe Experience Manager. Unlike reflected or stored XSS, DOM-based XSS occurs when client-side JavaScript writes attacker-controlled data into a sensitive DOM sink without proper sanitization. The malicious payload never needs to reach the server in an unencoded form, which allows it to bypass many server-side XSS filters.

The exploit chain requires an authenticated attacker with low privileges to craft a URL or page fragment that, when rendered by AEM client-side code, injects and executes JavaScript. A victim with an active AEM session must visit the crafted resource for the payload to execute. Because scope is changed, code executing in the browser can affect resources outside the vulnerable component's security authority, such as adjacent AEM applications sharing the same origin or trust context.

Root Cause

The root cause is improper neutralization of user-controllable input written into a DOM sink by client-side JavaScript in AEM. Sinks such as innerHTML, document.write, or eval receive attacker-influenced values from sources like location.hash, location.search, or postMessage data without adequate encoding or validation.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker with a low-privileged AEM account crafts a URL containing a malicious fragment or query parameter. The attacker delivers the link through phishing, embedded links, or a chat message. When the authenticated victim opens the link, vulnerable client-side code parses the input and injects JavaScript into the page, executing in the victim's browser under the AEM origin.

No verified proof-of-concept code has been published. Refer to the Adobe Security Advisory APSB26-98 for vendor-supplied technical details.

Detection Methods for CVE-2026-75695

Indicators of Compromise

Unusual AEM URLs containing script tags, javascript: URIs, or unusual fragment identifiers in web server or CDN access logs.
Browser console errors or Content Security Policy (CSP) violation reports referencing inline script execution on AEM origins.
Unexpected outbound requests from AEM authoring or publish origins to attacker-controlled domains shortly after a user clicks an inbound link.

Detection Strategies

Deploy a strict Content Security Policy with script-src restrictions and enable CSP report-only endpoints to surface injection attempts.
Inspect proxy and web application firewall (WAF) logs for AEM requests containing encoded angle brackets, event handlers such as onerror=, or javascript: schemes in query strings and fragments.
Correlate authenticated AEM sessions with anomalous DOM mutation or script-loading events using browser-side telemetry where available.

Monitoring Recommendations

Ingest AEM access logs, dispatcher logs, and CDN logs into a centralized data lake for retrospective hunting on crafted URL patterns.
Monitor for suspicious lateral movement following AEM user sessions, including token reuse and unexpected API calls from author accounts.
Alert on any modification of AEM configuration, users, or content packages performed from a session immediately after a click-through from an external referrer.

How to Mitigate CVE-2026-75695

Immediate Actions Required

Apply the fixes referenced in Adobe Security Advisory APSB26-98 to all AEM Cloud Service and AEM 6.5 LTS environments.
Audit low-privileged AEM accounts and remove or disable any that are unused, since exploitation requires authenticated access.
Enforce a strict Content Security Policy across AEM author and publish instances to constrain inline script execution.

Patch Information

Adobe has published remediation guidance in Security Advisory APSB26-98. Customers running AEM Cloud Service should confirm they are on the latest release channel. Customers running AEM 6.5 LTS should upgrade to the fixed service pack identified in the advisory. Consult the Adobe advisory for exact fixed versions and release notes.

Workarounds

Restrict access to AEM author instances behind VPN or IP allow-lists to reduce exposure to untrusted networks.
Configure the AEM dispatcher to filter suspicious query and fragment patterns that resemble XSS payloads.
Train editorial and administrative users to avoid clicking untrusted links while authenticated to AEM.

bash

# Example dispatcher filter snippet to block obvious XSS patterns in query strings
/0100 { /type "deny" /url '(?i)(<script|javascript:|onerror=|onload=)' }