CVE-2026-75704: Adobe Experience Manager XSS Vulnerability

CVE-2026-75704 Overview

CVE-2026-75704 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM). An attacker can manipulate the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction, as the victim must visit a crafted webpage. The vulnerability results in a scope change, allowing impact to extend beyond the vulnerable component. This flaw is classified under CWE-79, Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser, potentially leading to session hijacking, credential theft, or unauthorized actions performed under the victim's identity.

Affected Products

Adobe Experience Manager (on-premise)
Adobe Experience Manager Cloud Service (AEM Cloud Service)
Adobe Experience Manager 6.5 LTS (including SP1, SP2)

Discovery Timeline

2026-09-08 - CVE-2026-75704 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75704

Vulnerability Analysis

CVE-2026-75704 is a client-side XSS vulnerability triggered entirely within the browser's Document Object Model (DOM). Unlike reflected or stored XSS, DOM-based XSS occurs when client-side JavaScript writes attacker-controlled data into the DOM without proper sanitization. The attacker's payload never necessarily reaches the server, which makes traditional server-side filters ineffective at blocking exploitation.

Because the CVSS scope is changed, injected script executes in a security context different from the vulnerable component. The attacker requires low privileges on the target application to stage the attack, and the victim must interact with attacker-controlled content.

Root Cause

The root cause is improper neutralization of user-supplied input rendered by client-side JavaScript within Adobe Experience Manager. Vulnerable code paths take untrusted data from sources such as location.hash, document.URL, or postMessage payloads and pass it to dangerous sinks including innerHTML, document.write, or eval without encoding or validation. Adobe has not published detailed technical internals beyond advisory APSB26-98.

Attack Vector

An attacker with authenticated low-privilege access to an AEM instance crafts a malicious URL or webpage containing a payload targeting the vulnerable DOM sink. The victim, typically an authenticated AEM user or administrator, visits the crafted link. The browser processes the payload and executes attacker-controlled JavaScript within the AEM origin, enabling session token theft, forced content modifications, or pivoting to further application actions.

No verified public proof-of-concept code is available for CVE-2026-75704. Refer to the Adobe Security Advisory APSB26-98 for vendor-supplied technical details.

Detection Methods for CVE-2026-75704

Indicators of Compromise

Web server or reverse-proxy logs containing suspicious URL fragments with <script>, javascript:, onerror=, or encoded variants targeting AEM endpoints.
Browser console errors or Content Security Policy (CSP) violation reports referencing inline script execution on AEM origins.
Anomalous outbound requests from authenticated AEM user sessions to unfamiliar external domains, suggesting session token exfiltration.

Detection Strategies

Deploy a Content Security Policy in report-only mode to identify unexpected script sources loading in AEM authoring and publish tiers.
Enable web application firewall (WAF) rulesets that inspect fragment identifiers and query parameters for XSS patterns targeting AEM paths.
Correlate authentication events with unusual client-side activity, such as rapid asset modifications, using centralized logging.

Monitoring Recommendations

Continuously monitor AEM access logs for repeated requests containing DOM-manipulation payloads or encoded script tags.
Alert on CSP violation reports originating from AEM hostnames, particularly unsafe-inline script execution attempts.
Track privileged AEM user sessions for behavioral anomalies indicative of hijacked accounts.

How to Mitigate CVE-2026-75704

Immediate Actions Required

Apply the Adobe security update referenced in APSB26-98 to all affected AEM instances.
Review AEM 6.5 LTS deployments and upgrade to the patched service pack level provided by Adobe.
Rotate session tokens and API keys for AEM administrator accounts after patching, in case of prior exploitation.

Patch Information

Adobe released fixes for Adobe Experience Manager Cloud Service and Adobe Experience Manager 6.5 LTS as documented in advisory APSB26-98. Customers on AEM Cloud Service should confirm their tenant is running the latest release cadence. On-premise AEM 6.5 LTS customers must install the vendor-provided cumulative fix pack that addresses this issue.

Workarounds

Enforce a strict Content Security Policy that disallows unsafe-inline and restricts script sources to trusted origins.
Restrict AEM authoring interface access to trusted networks and require multi-factor authentication for all users with content editing privileges.
Educate content authors and administrators to avoid clicking untrusted links while authenticated to AEM.

bash

# Example CSP header to reduce DOM-XSS impact on AEM origins
Content-Security-Policy: default-src 'self'; \
  script-src 'self' 'nonce-{random}'; \
  object-src 'none'; \
  base-uri 'self'; \
  frame-ancestors 'self'; \
  report-uri /csp-report-endpoint