CVE-2026-75696: Adobe Experience Manager XSS Vulnerability

CVE-2026-75696 Overview

Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting (XSS) vulnerability [CWE-79]. An attacker can manipulate the Document Object Model (DOM) environment to execute malicious JavaScript within the context of a victim's browser session. Exploitation requires user interaction, specifically that a victim visits a crafted webpage. The scope is changed, meaning the impact extends beyond the vulnerable component to affect resources managed by other security authorities.

Adobe published the vulnerability details in security advisory APSB26-98. The issue affects multiple AEM versions including AEM Cloud Service and AEM 6.5 LTS releases.

Critical Impact
An authenticated attacker can execute arbitrary JavaScript in the victim's browser, enabling session token theft, unauthorized content modifications, and further client-side attacks against AEM users.

Affected Products

Adobe Experience Manager Cloud Service (AEM CS)
Adobe Experience Manager 6.5 LTS (base release, SP1, SP2)
Adobe Experience Manager (all versions prior to the APSB26-98 fix)

Discovery Timeline

2026-09-08 - CVE-2026-75696 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75696

Vulnerability Analysis

The vulnerability resides in client-side JavaScript that processes attacker-influenced input without adequate sanitization before writing it to a DOM sink. When AEM renders user-controlled data through unsafe DOM manipulation methods, an attacker can inject JavaScript that the browser executes in the origin context of the AEM application.

Because the flaw is DOM-based, the malicious payload never needs to reach the server in reflected or stored form. The exploit executes entirely within the browser after the victim loads a crafted URL or page.

The changed scope indicates the vulnerability affects resources beyond the originally vulnerable component. In practice, this often means script execution can reach authenticated content authoring interfaces or administrative surfaces distinct from the initial injection point.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79] within client-side script. AEM code passes untrusted data — typically extracted from the URL fragment, query parameters, postMessage events, or document.referrer — into DOM APIs such as innerHTML, document.write, or eval without contextual encoding.

Attack Vector

The attack requires low privileges and user interaction. An attacker with a low-privileged AEM account crafts a URL that manipulates DOM state to trigger the sink. The attacker then delivers the URL to an authenticated victim via phishing, chat, or an embedded link. When the victim's browser loads the page, the injected JavaScript runs in the AEM origin and can steal session cookies, perform actions on behalf of the victim, or pivot to higher-privileged workflows.

Refer to the Adobe Security Advisory APSB26-98 for vendor technical details. No public proof-of-concept exploit is available at the time of publication.

Detection Methods for CVE-2026-75696

Indicators of Compromise

Unusual outbound requests from authenticated AEM user sessions to attacker-controlled domains, often carrying session tokens or cookie values in query strings.
AEM access logs showing requests with suspicious URL fragments, encoded <script> tags, or javascript: URIs targeting AEM author or publish instances.
Unexpected content modifications, user account changes, or configuration edits performed by low-privileged accounts.

Detection Strategies

Deploy a Content Security Policy (CSP) in report-only mode and monitor violation reports for inline script execution attempts on AEM pages.
Inspect referrer headers and fragment identifiers in AEM web server logs for payloads matching common DOM-XSS patterns such as onerror=, onload=, or Base64-encoded scripts.
Correlate authentication events with subsequent anomalous administrative activity from the same session.

Monitoring Recommendations

Enable verbose logging on AEM dispatcher and author instances, forwarding logs to a centralized analytics platform for pattern matching.
Monitor browser-side telemetry through Real User Monitoring (RUM) or endpoint agents for script injection artifacts on AEM origins.
Alert on any AEM user session that initiates cross-origin requests to previously unseen external domains within a short window after login.

How to Mitigate CVE-2026-75696

Immediate Actions Required

Apply the security updates referenced in Adobe advisory APSB26-98 to all AEM Cloud Service, AEM 6.5 LTS base, SP1, and SP2 environments.
Review AEM user accounts and enforce least privilege, removing unnecessary author or content-editing permissions.
Rotate session secrets and force reauthentication for privileged AEM users following patch deployment.

Patch Information

Adobe released fixes for CVE-2026-75696 in the updates documented in Adobe Security Advisory APSB26-98. Administrators of AEM Cloud Service should confirm their tenant is on the patched release, while on-premises AEM 6.5 LTS operators must install the corresponding service pack update.

Workarounds

Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins, reducing the impact of DOM injection.
Configure the AEM dispatcher to filter or reject requests containing suspicious characters in query strings and fragments where feasible.
Require multi-factor authentication for all AEM author instance users to limit the value of stolen sessions.

bash

# Example dispatcher.any filter tightening high-risk URL patterns
/filter {
  /0001 { /type "deny" /url "*<script*" }
  /0002 { /type "deny" /url "*javascript:*" }
  /0003 { /type "deny" /url "*onerror=*" }
  /0004 { /type "deny" /url "*onload=*" }
}