CVE-2026-75701: Adobe Experience Manager XSS Vulnerability

CVE-2026-75701 Overview

Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-75701. An attacker can manipulate the Document Object Model (DOM) to execute arbitrary JavaScript within the victim's browser session. Exploitation requires the victim to visit a crafted webpage and requires low-privileged authentication on the target application. The vulnerability affects both Adobe Experience Manager Cloud Service and AEM 6.5 LTS releases through service pack 2. Because the scope is changed, code executes across a different security boundary than the vulnerable component. The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows execution of attacker-controlled JavaScript in the AEM author or publish context, enabling session theft, content manipulation, and pivoting into authenticated AEM workflows.

Affected Products

Adobe Experience Manager Cloud Service (AEM CS)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS Service Pack 1 and Service Pack 2

Discovery Timeline

2026-09-08 - CVE-2026-75701 published to the National Vulnerability Database
2026-09-08 - Adobe publishes Security Advisory APSB26-98
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75701

Vulnerability Analysis

The vulnerability resides in client-side JavaScript executed by Adobe Experience Manager. AEM processes untrusted input from a DOM source, such as location.hash, document.referrer, or window.name, and passes it to a sink that treats the value as executable script or markup. Sinks of this class include innerHTML, document.write, and eval. Because the injection happens entirely in the browser, the malicious payload never appears in server-side HTTP responses, which limits detection by traditional web application firewalls.

An authenticated user with low privileges can craft a URL that embeds a malicious payload. When another AEM user opens that URL, the vulnerable script parses the DOM-controlled value and injects it into the page. The scope change indicates the injected script runs in a different security context than the vulnerable component, for example inside an authenticated authoring session.

Root Cause

The root cause is missing or insufficient output encoding on data flowing from a DOM source to a DOM sink. AEM front-end code trusts values controlled by the URL fragment or other client-side inputs and writes them into the page without contextual escaping. This maps directly to [CWE-79] Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker distributes a crafted link, typically through phishing or a compromised referrer, that points at a vulnerable AEM URL with an attacker-controlled fragment or parameter. When an authenticated AEM user follows the link, the browser evaluates the injected JavaScript inside the AEM origin. The attacker can then read session tokens, submit content changes, or trigger authenticated API calls on behalf of the victim. No verified proof-of-concept code is publicly available at this time; refer to the Adobe Security Advisory APSB26-98 for vendor technical details.

Detection Methods for CVE-2026-75701

Indicators of Compromise

Unusual URL fragments or query parameters containing HTML tags, javascript: URIs, or encoded <script> payloads directed at AEM author or publish hosts.
Browser console errors or Content Security Policy violation reports originating from AEM pages after users click external links.
Unexpected outbound requests from authenticated AEM sessions to attacker-controlled domains carrying cookies or CSRF tokens.

Detection Strategies

Review AEM access logs and reverse-proxy logs for requests that contain suspicious characters such as <, >, %3C, %3E, or onerror= in URL fragments and query strings.
Deploy a strict Content Security Policy in report-only mode and monitor report-uri endpoints for violations that indicate DOM injection attempts.
Correlate authentication events with anomalous administrative API calls originating from the same session shortly after a user clicked an external URL.

Monitoring Recommendations

Ingest AEM Dispatcher, author, and publish logs into a centralized analytics platform and alert on XSS-indicative patterns.
Enable browser-based telemetry through CSP violation reports and JavaScript error tracking to surface unexpected script execution.
Track sessions that generate a high rate of failed CSRF checks or unusual JCR content modifications immediately after link clicks.

How to Mitigate CVE-2026-75701

Immediate Actions Required

Apply the fixed release identified in Adobe Security Advisory APSB26-98 to all AEM Cloud Service and AEM 6.5 LTS instances.
Restrict AEM author access to trusted networks and enforce multi-factor authentication for all authoring and administrator accounts.
Educate content authors and administrators to avoid clicking untrusted links while authenticated to AEM.

Patch Information

Adobe addresses CVE-2026-75701 in the updates listed in APSB26-98. Customers on AEM Cloud Service receive fixes through the standard release train, while AEM 6.5 LTS customers must install the service pack referenced by the advisory. Verify the deployed version against the advisory's fixed version table after upgrade.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Configure the AEM Dispatcher to reject request URLs containing HTML metacharacters or script-related tokens in query strings and fragments where feasible.
Segment author instances behind a VPN and disable direct internet exposure until the patch is applied.

bash

# Example CSP header for AEM Dispatcher (Apache httpd)
Header always set Content-Security-Policy "default-src 'self'; \
  script-src 'self'; \
  object-src 'none'; \
  base-uri 'self'; \
  frame-ancestors 'self'; \
  report-uri /csp-report"