CVE-2026-75707: Adobe Experience Manager XSS Vulnerability

CVE-2026-75707 Overview

Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-75707. An attacker can manipulate the Document Object Model (DOM) environment to execute arbitrary JavaScript in the victim's browser context. Exploitation requires user interaction: the victim must visit a crafted webpage. The vulnerability carries a changed scope, meaning code execution can affect resources beyond the vulnerable component's security authority. The issue affects both AEM Cloud Service and AEM 6.5 LTS releases through Service Pack 2. Adobe published guidance in security advisory APSB26-98.

Critical Impact
An authenticated low-privilege attacker can execute malicious JavaScript in a victim's browser session, enabling session token theft, content manipulation, and pivoting into other trust domains due to the changed CVSS scope.

Affected Products

Adobe Experience Manager Cloud Service (AEM CS)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS Service Pack 1 and Service Pack 2

Discovery Timeline

2026-09-08 - CVE-2026-75707 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75707

Vulnerability Analysis

CVE-2026-75707 is a DOM-based Cross-Site Scripting flaw classified under CWE-79, Improper Neutralization of Input During Web Page Generation. Unlike reflected or stored XSS, DOM-based XSS executes entirely on the client side. Attacker-controlled data flows from a source such as location.hash, document.URL, or window.name into a dangerous sink such as innerHTML, document.write, or eval without sanitization.

When an authenticated AEM user visits a crafted page, JavaScript already loaded by AEM parses the malicious input and writes it into the DOM. The browser then executes the injected script within the origin of the AEM instance. The changed scope indicates the injected code can reach resources managed by a different security authority, such as parent frames, adjacent applications, or federated single sign-on sessions.

Root Cause

The root cause is unsafe handling of client-side data within AEM's JavaScript layer. Developer-controlled JavaScript reads values from a browser source and passes them to a sink that interprets HTML or executes script. No output encoding or DOM Purify-style sanitization is applied before the value reaches the sink.

Attack Vector

The attack vector is network-based and requires low privileges plus user interaction. An attacker crafts a URL or webpage that, when loaded by an authenticated AEM user, triggers the vulnerable client-side code path. The injected JavaScript inherits the victim's AEM session and can call authenticated endpoints, exfiltrate content, or manipulate the author environment.

No verified proof-of-concept code has been published. See the Adobe Security Advisory APSB26-98 for vendor-supplied technical details.

Detection Methods for CVE-2026-75707

Indicators of Compromise

Unusual outbound requests from authenticated AEM author or publish sessions to attacker-controlled domains carrying cookie or token values in URL parameters.
HTTP referer logs showing AEM users arriving from external URLs containing encoded <script>, javascript:, or data: payloads in fragments or query strings.
Unexpected modifications to AEM content, page properties, or component configurations performed by legitimate accounts outside normal working patterns.

Detection Strategies

Inspect web server and CDN logs for requests to AEM URLs containing suspicious characters in the fragment (#) portion, such as %3Cscript, onerror=, or javascript:.
Enable and review Content Security Policy (CSP) violation reports to identify inline script execution attempts blocked by policy.
Correlate authenticated AEM API calls with browser referer and user-agent anomalies to flag session activity initiated by injected scripts.

Monitoring Recommendations

Forward AEM dispatcher, publish, and author access logs to a centralized SIEM for continuous inspection of URL fragments and query parameters.
Monitor authenticated sessions for concurrent geolocation or IP anomalies that may indicate token theft following successful XSS execution.
Track outbound egress from AEM administrative browsers to non-corporate destinations, particularly short-lived domains and paste services.

How to Mitigate CVE-2026-75707

Immediate Actions Required

Apply the patched versions listed in Adobe Security Advisory APSB26-98 for AEM Cloud Service and AEM 6.5 LTS.
Invalidate active AEM author and publish sessions after patching to force re-authentication and revoke any tokens potentially exposed prior to remediation.
Audit AEM user accounts, focusing on privileged authors and administrators, and enforce multi-factor authentication where supported.

Patch Information

Adobe released fixed builds for AEM Cloud Service and AEM 6.5 LTS SP2 as documented in advisory APSB26-98. Cloud Service customers receive updates through Adobe's managed release channel. On-premises AEM 6.5 LTS operators must download and deploy the corresponding cumulative fix pack from the Adobe Software Distribution portal. Verify patch application by checking the installed hotfix inventory in the AEM Web Console.

Workarounds

Deploy a strict Content Security Policy that disallows unsafe-inline and unsafe-eval and restricts script sources to trusted origins.
Configure the AEM Dispatcher to filter and reject requests containing HTML control characters or javascript: schemes in query strings and fragments.
Restrict AEM author instance access to VPN or IP-allowlisted networks to reduce exposure to attacker-hosted crafted pages targeting authenticated authors.

bash

# Example AEM Dispatcher filter rule to block common XSS payload patterns
/0100 { /type "deny" /url '*<script*' }
/0101 { /type "deny" /url '*javascript:*' }
/0102 { /type "deny" /url '*onerror=*' }
/0103 { /type "deny" /url '*onload=*' }