CVE-2026-75705: Adobe Experience Manager XSS Vulnerability

CVE-2026-75705 Overview

Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting (XSS) vulnerability [CWE-79] that allows attackers to execute arbitrary JavaScript in a victim's browser. The flaw affects AEM Cloud Service and AEM 6.5 LTS releases including base, SP1, and SP2. Exploitation requires an authenticated attacker with low privileges and user interaction, as the victim must visit a crafted webpage. Because the vulnerability has a changed scope, malicious script execution can affect resources beyond the initially vulnerable component.

Critical Impact
Successful exploitation lets attackers run JavaScript in an authenticated user's browser session, enabling session data theft, unauthorized actions in the AEM interface, and impact across trust boundaries due to the scope change.

Affected Products

Adobe Experience Manager Cloud Service (AEM as a Cloud Service)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS SP1 and SP2

Discovery Timeline

2026-09-08 - CVE-2026-75705 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75705

Vulnerability Analysis

The vulnerability is a client-side DOM-based XSS issue in Adobe Experience Manager. Unlike reflected or stored XSS, DOM-based XSS occurs entirely within the victim's browser when JavaScript in the page reads attacker-controlled data from a DOM source and passes it to a dangerous sink without proper sanitization. The result is JavaScript execution in the origin of the AEM instance.

Exploitation requires network access to an AEM instance, low-privilege authentication, and user interaction. The scope change means executed script can act on resources outside the vulnerable component's security scope, expanding the reachable attack surface within the AEM environment.

Root Cause

The root cause is unsafe handling of DOM-controlled input by client-side JavaScript in AEM. Attacker-influenced values reach a sink such as innerHTML, document.write, or eval without contextual output encoding or safe-DOM APIs. This is a classic Improper Neutralization of Input During Web Page Generation weakness [CWE-79].

Attack Vector

An authenticated low-privilege user must be lured to a crafted URL or page that manipulates the DOM environment of the AEM application. When the victim's browser processes the crafted content, the vulnerable client-side code renders attacker-supplied script into the page context and executes it. No verified public proof-of-concept or exploit code is available at this time; refer to the Adobe Security Advisory APSB26-98 for vendor-provided details.

Detection Methods for CVE-2026-75705

Indicators of Compromise

Requests to AEM endpoints containing suspicious URL fragments, encoded HTML tags, or JavaScript keywords such as <script>, javascript:, or onerror= in query strings or hash fragments.
Unexpected outbound requests from AEM author or publish instances to unfamiliar external domains following user navigation.
Anomalous session activity for authenticated AEM accounts, including actions performed outside typical business hours or from atypical IP addresses.

Detection Strategies

Deploy Content Security Policy (CSP) reporting in front of AEM interfaces to surface inline script and unauthorized script-source violations.
Inspect web server and reverse-proxy logs for URLs containing XSS payload patterns targeting AEM paths such as /content/, /apps/, or /etc/.
Correlate authenticated AEM sessions with browser-side telemetry to identify script execution originating from unexpected DOM sources.

Monitoring Recommendations

Enable verbose access logging on AEM dispatcher and origin servers, and forward logs to a centralized analytics platform for pattern analysis.
Monitor authentication events for low-privilege AEM accounts, focusing on session reuse from multiple IP addresses.
Track CSP violation reports and web application firewall alerts referencing AEM URIs to identify targeting activity.

How to Mitigate CVE-2026-75705

Immediate Actions Required

Apply the fixes referenced in Adobe Security Advisory APSB26-98 to all AEM Cloud Service and AEM 6.5 LTS instances.
Inventory all AEM deployments, including author, publish, and dispatcher tiers, to confirm patch coverage.
Rotate active AEM user sessions and require re-authentication after patching to invalidate any session tokens potentially exposed to script execution.

Patch Information

Adobe has released updates addressing this vulnerability. Refer to Adobe Security Advisory APSB26-98 for the specific fixed versions applicable to AEM as a Cloud Service and AEM 6.5 LTS SP1 and SP2. Apply the vendor updates through the standard AEM update process for your deployment model.

Workarounds

Enforce a strict Content Security Policy on AEM instances to limit inline script execution and restrict script sources to trusted origins.
Restrict access to AEM author instances to trusted networks and VPNs to reduce the population of low-privilege attackers who can reach the vulnerable interfaces.
Provide user awareness guidance to AEM authors and administrators warning against clicking untrusted links that reference AEM URLs.

bash

# Example CSP header to reduce DOM-XSS impact on AEM responses
# Apply via AEM dispatcher or upstream reverse proxy
Content-Security-Policy: default-src 'self'; \
  script-src 'self'; \
  object-src 'none'; \
  base-uri 'self'; \
  frame-ancestors 'self'; \
  report-uri /csp-report