CVE-2026-75702: Adobe Experience Manager XSS Vulnerability

CVE-2026-75702 Overview

Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-75702. Attackers can manipulate the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction, meaning a victim must visit a crafted webpage. The vulnerability has a changed scope, allowing impact beyond the vulnerable component. Adobe published security advisory APSB26-98 addressing the flaw across AEM Cloud Service and AEM 6.5 LTS releases through Service Pack 2. The issue is categorized under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in an authenticated user's browser session, enabling session data theft, unauthorized actions, and content manipulation within AEM.

Affected Products

Adobe Experience Manager AEM Cloud Service
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS Service Pack 1 and Service Pack 2

Discovery Timeline

2026-09-08 - CVE-2026-75702 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75702

Vulnerability Analysis

CVE-2026-75702 is a DOM-based XSS flaw in Adobe Experience Manager. Unlike reflected or stored XSS, DOM-based XSS executes entirely within the client-side script by writing attacker-controlled data into a sensitive sink such as innerHTML, document.write, or eval. The vulnerable code path in AEM parses untrusted input from a source like location.hash, location.search, or document.referrer without sufficient sanitization before rendering it into the page.

The scope-changed classification indicates that a successful attack impacts resources beyond the vulnerable component's security authority. An attacker exploiting an authoring or preview interface can influence content or actions in a different security context. Exploitation requires low privileges and user interaction, so an attacker typically needs a valid low-privileged AEM account and must lure a victim to a crafted URL.

Root Cause

The root cause is improper neutralization of user-controllable input consumed by client-side JavaScript within AEM. The affected script does not validate or encode data before passing it to a DOM sink capable of executing markup or script. Standard server-side output encoding provides no protection because the malicious payload never reaches the server in a form that would trigger reflection filters.

Attack Vector

The attack is network-reachable and requires a victim to load a crafted URL containing a JavaScript payload in a DOM source. When the AEM page loads, vulnerable client-side code reads the tainted value and inserts it into the DOM, causing the browser to execute the payload with the victim's AEM session privileges. See the Adobe Security Advisory APSB26-98 for vendor technical details.

Detection Methods for CVE-2026-75702

Indicators of Compromise

AEM access logs containing requests with suspicious URL fragments, query parameters, or hash values embedding <script>, javascript:, onerror=, or encoded variants targeting known AEM authoring or preview endpoints.
Unexpected outbound HTTP requests from AEM author or publish user browsers to attacker-controlled domains following visits to internal AEM URLs.
Anomalous AEM administrative actions or content modifications originating from low-privileged accounts shortly after a user clicks an external link.

Detection Strategies

Deploy a Content Security Policy (CSP) in report-only mode and monitor Content-Security-Policy-Report-Only violation reports for inline script execution attempts on AEM domains.
Correlate web proxy and endpoint browser telemetry to identify AEM session cookies being transmitted to non-Adobe domains.
Hunt for AEM URLs containing HTML or JavaScript syntax in the fragment or query string across web application firewall (WAF) and reverse proxy logs.

Monitoring Recommendations

Ingest AEM access logs, WAF logs, and browser proxy telemetry into a centralized SIEM to build correlation rules targeting DOM XSS indicators.
Monitor authenticated AEM sessions for concurrent activity from geographically inconsistent sources, which may indicate session hijacking following XSS exploitation.
Track outbound connections from AEM author instances and privileged content editor workstations to newly registered or low-reputation domains.

How to Mitigate CVE-2026-75702

Immediate Actions Required

Apply the security updates referenced in Adobe Security Advisory APSB26-98 to AEM Cloud Service and AEM 6.5 LTS deployments.
Audit AEM user accounts and revoke unused low-privileged accounts that could be leveraged to satisfy the attack's authentication requirement.
Instruct AEM authors and administrators to avoid clicking untrusted links while authenticated to AEM interfaces until patches are deployed.

Patch Information

Adobe addressed CVE-2026-75702 in the updates listed in security bulletin APSB26-98. Customers on AEM Cloud Service receive the fix through the managed release channel. Customers running AEM 6.5 LTS, including Service Pack 1 and Service Pack 2, must install the vendor-provided cumulative update. Refer to the Adobe Security Advisory APSB26-98 for exact fixed versions and download instructions.

Workarounds

Deploy a strict Content Security Policy on AEM author and publish instances that disallows inline scripts and restricts script sources to trusted origins.
Place a WAF in front of AEM instances with rules that inspect and block requests containing HTML or JavaScript syntax in query parameters and fragments where feasible.
Restrict AEM author interface access to a VPN or IP allowlist to reduce exposure to externally delivered crafted URLs.

bash

# Example Content-Security-Policy header for AEM responses
Content-Security-Policy: default-src 'self'; \
  script-src 'self' 'nonce-RANDOMNONCE'; \
  object-src 'none'; \
  base-uri 'self'; \
  frame-ancestors 'self'; \
  report-uri /csp-report-endpoint