CVE-2026-75700: Adobe Experience Manager XSS Vulnerability

CVE-2026-75700 Overview

Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-75700. An attacker can manipulate the Document Object Model to execute arbitrary JavaScript within the victim's browser session. Exploitation requires user interaction: the victim must visit a crafted webpage. The vulnerability has a changed scope, meaning the impact extends beyond the vulnerable component into other security contexts. The flaw is categorized under [CWE-79] and affects both the on-premise AEM 6.5 LTS product family and AEM Cloud Service deployments.

Critical Impact
A successful attack allows execution of malicious JavaScript in the victim's browser under the AEM origin, enabling session data theft, unauthorized actions on behalf of authenticated users, and pivoting into content authoring workflows.

Affected Products

Adobe Experience Manager Cloud Service (AEM CS)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS Service Pack 1 and Service Pack 2

Discovery Timeline

2026-09-08 - CVE-2026-75700 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75700

Vulnerability Analysis

CVE-2026-75700 is a DOM-based XSS flaw in Adobe Experience Manager. Unlike reflected or stored XSS, DOM-based XSS occurs entirely within client-side JavaScript. The vulnerable code reads attacker-controllable data from a DOM source and passes it to a sink that renders it as executable script.

The attack targets authenticated AEM users, typically content authors and administrators using the AEM console. Because the scope is changed, script executed within the AEM origin can reach resources or contexts that trust the AEM application, amplifying the impact beyond a single vulnerable page.

Successful exploitation compromises session confidentiality and integrity. An attacker can read authentication tokens rendered in the page, submit authenticated requests through the victim's browser, and manipulate content that other AEM users consume.

Root Cause

The root cause is insufficient neutralization of input during web page generation on the client side. AEM JavaScript processes untrusted DOM sources, such as URL fragments or query parameters, and inserts the values into an unsafe sink such as innerHTML, document.write, or a script evaluation function without appropriate encoding or sanitization.

Attack Vector

Exploitation is network-based and requires low privileges plus user interaction. An attacker with a low-privileged AEM account crafts a malicious URL pointing to an AEM page and delivers it to a higher-privileged victim through phishing, chat, or a link on an untrusted site. When the victim opens the URL while authenticated to AEM, the malicious payload embedded in the URL is processed by vulnerable client-side JavaScript and executed in the AEM origin. Refer to the Adobe Experience Manager Security Advisory for vendor technical details.

Detection Methods for CVE-2026-75700

Indicators of Compromise

AEM access log entries showing requests to authoring or preview URLs containing suspicious fragments or query parameters with encoded <script>, javascript:, or onerror= payloads.
Outbound browser requests from AEM author sessions to unfamiliar external hosts shortly after a user clicks a shared link.
Unexpected content modifications, new user accounts, or permission changes performed from an authenticated author session.

Detection Strategies

Deploy Content Security Policy (CSP) reporting endpoints to capture inline script violations originating from AEM origins.
Correlate web proxy logs with AEM audit logs to identify authenticated author sessions that follow externally referred URLs before performing privileged actions.
Inspect referer patterns and URL fragments in AEM Dispatcher logs for encoded JavaScript primitives.

Monitoring Recommendations

Monitor AEM audit logs for unusual configuration or content changes performed within seconds of a login or link-click event.
Alert on browser telemetry showing script execution from AEM origins that contacts non-Adobe domains.
Track EPSS movement and Adobe advisory updates for changes in exploit probability following the current EPSS score of 0.249%.

How to Mitigate CVE-2026-75700

Immediate Actions Required

Apply the updates referenced in Adobe Security Bulletin APSB26-98 to all AEM 6.5 LTS instances and confirm AEM Cloud Service tenants are on the patched release channel.
Restrict AEM author console access to trusted networks and VPN-authenticated users to reduce exposure to crafted links.
Educate content authors and administrators to avoid opening AEM URLs received from untrusted sources while logged into the console.

Patch Information

Adobe has published fixed builds in security bulletin APSB26-98 covering AEM 6.5 LTS (including SP1 and SP2) and AEM Cloud Service. Administrators should install the latest service pack or cumulative fix pack listed in the advisory. Cloud Service customers receive the fix through the standard managed release process. Full remediation guidance is available in the Adobe Experience Manager Security Advisory.

Workarounds

Enforce a strict Content Security Policy on AEM author and publish instances that disallows inline scripts and untrusted script sources.
Configure the AEM Dispatcher to filter or reject requests containing suspicious query parameters and URL fragments associated with script payloads.
Require re-authentication for sensitive AEM operations to reduce the value of a hijacked session obtained via XSS.

bash

# Example AEM Dispatcher filter to block obvious script payloads in query strings
/0100 { /type "deny" /url '*<script*' }
/0101 { /type "deny" /url '*javascript:*' }
/0102 { /type "deny" /url '*onerror=*' }