CVE-2026-75710: Adobe Experience Manager XSS Vulnerability

CVE-2026-75710 Overview

Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-75710. An attacker can manipulate the client-side Document Object Model (DOM) environment to execute arbitrary JavaScript within the victim's browser session. Exploitation requires user interaction: the victim must visit a crafted webpage. The vulnerability has a changed scope, meaning code executes with access beyond the vulnerable component's original security context. Adobe published Security Advisory APSB26-98 addressing this issue across AEM Cloud Service and AEM 6.5 LTS releases.

Critical Impact
Successful exploitation allows attackers to execute malicious JavaScript in the context of an authenticated AEM user, potentially leading to session hijacking, credential theft, or unauthorized content modification.

Affected Products

Adobe Experience Manager Cloud Service (AEM CS)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS SP1 and SP2

Discovery Timeline

2026-09-08 - CVE-2026-75710 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75710

Vulnerability Analysis

The flaw is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation. Unlike reflected or stored XSS, DOM-based XSS occurs entirely within the client-side JavaScript execution environment. A vulnerable script reads attacker-controlled data from a DOM source such as document.location, document.URL, or window.name, and writes it to a sink such as innerHTML, document.write, or eval without proper sanitization.

Because the injection occurs in the browser, the malicious payload may never appear in server-side logs. This complicates detection through traditional web application firewall (WAF) or server telemetry alone. The changed scope indicator means the injected script executes with authority beyond the originally vulnerable component, increasing the blast radius across the AEM authoring environment.

Root Cause

AEM client-side scripts consume DOM data from untrusted sources and pass it to dangerous sinks without contextual output encoding. When a victim loads a crafted URL, the vulnerable JavaScript parses attacker-supplied fragments or parameters and injects them into the live DOM. This produces script execution under the origin of the AEM instance.

Attack Vector

Exploitation is network-based and requires the attacker to convince an authenticated AEM user (low-privilege author or administrator) to visit a crafted link. Once the page loads, embedded JavaScript executes in the AEM origin. The attacker can then perform actions on behalf of the victim, exfiltrate session tokens, or pivot to content manipulation. See the Adobe Security Advisory APSB26-98 for vendor technical details.

Detection Methods for CVE-2026-75710

Indicators of Compromise

Unexpected outbound requests from AEM author sessions to attacker-controlled domains carrying cookie or token data in query strings.
AEM audit log entries showing content, workflow, or user modifications made from anomalous IP addresses or user agents.
Browser console evidence of dynamically injected <script> elements or inline event handlers within AEM author pages.

Detection Strategies

Inspect HTTP referer headers reaching AEM endpoints for suspicious external origins that immediately precede sensitive author actions.
Deploy Content Security Policy (CSP) reporting to capture script-src violations that indicate DOM injection attempts.
Correlate authenticated user activity with rapid, atypical DOM-triggered actions such as bulk publish or user role changes.

Monitoring Recommendations

Ingest AEM access.log and audit.log into a centralized analytics platform and alert on anomalous author-session behavior.
Monitor for URL patterns containing encoded JavaScript fragments (javascript:, %3Cscript, onerror=) targeting AEM hostnames.
Track browser telemetry from privileged AEM users for redirects to unrecognized domains following link clicks.

How to Mitigate CVE-2026-75710

Immediate Actions Required

Apply the fixed versions distributed through Adobe Security Bulletin APSB26-98 for AEM Cloud Service and AEM 6.5 LTS.
Restrict AEM author instance access to trusted networks or VPN-only paths to limit exposure to crafted external links.
Train content authors and administrators to avoid clicking untrusted links while authenticated to AEM.

Patch Information

Adobe addressed CVE-2026-75710 in the AEM releases listed in Adobe Security Advisory APSB26-98. Customers on AEM as a Cloud Service receive the fix through the standard release cadence. AEM 6.5 LTS deployments must upgrade to the service pack identified in the advisory.

Workarounds

Enforce a strict Content Security Policy (CSP) on AEM author and publish instances to block inline script execution and unauthorized script sources.
Place AEM author environments behind a reverse proxy that strips or normalizes URL fragments and query parameters known to trigger the vulnerable code path.
Require re-authentication for sensitive AEM actions to reduce the value of a hijacked session obtained via XSS.

bash

# Example Dispatcher/CSP header configuration to reduce XSS impact
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"