CVE-2026-75712: Adobe Experience Manager XSS Vulnerability

CVE-2026-75712 Overview

CVE-2026-75712 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM). An attacker can manipulate the DOM environment to execute malicious JavaScript within the context of a victim's browser session. Exploitation requires user interaction, specifically that a victim visits a crafted webpage. The vulnerability has a changed scope, meaning it can impact resources beyond the initially vulnerable component. This flaw is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of the authenticated user.

Affected Products

Adobe Experience Manager (AEM Cloud Service)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS SP1 and SP2

Discovery Timeline

2026-09-08 - CVE-2026-75712 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75712

Vulnerability Analysis

CVE-2026-75712 is a client-side DOM-based XSS vulnerability affecting Adobe Experience Manager. The flaw resides in JavaScript code that processes untrusted input from the Document Object Model and writes it back to the page without proper sanitization. Because the payload never traverses the server, traditional server-side XSS filters and web application firewalls often fail to detect the attack. The scope change means an attacker executing script in AEM can potentially affect authentication tokens or session state belonging to other origins or components. Authenticated low-privilege users represent a viable attack path when combined with a social engineering lure.

Root Cause

The root cause is improper neutralization of user-controllable data used in client-side JavaScript sinks such as document.write, innerHTML, eval, or location.href. When AEM client libraries pass attacker-controlled fragments (for example, URL parameters or hash values) to these sinks without encoding, the browser interprets injected markup as executable script.

Attack Vector

An attacker crafts a URL containing a malicious JavaScript payload and delivers it to a victim through phishing, chat, or a compromised referrer. When the victim, who must be authenticated to the AEM instance, visits the URL, the vulnerable client-side script parses the payload and injects it into the DOM. The script then executes in the origin of the AEM application with the victim's session context.

No verified proof-of-concept code has been published. Refer to the Adobe Security Advisory APSB26-98 for vendor-provided technical details.

Detection Methods for CVE-2026-75712

Indicators of Compromise

Unusual URL parameters or fragment identifiers containing HTML entities, <script> tags, javascript: URIs, or encoded event handlers such as onerror= or onload=.
Outbound requests from AEM authoring or publish nodes to unfamiliar external domains shortly after user page loads.
Unexpected creation of new administrative users, modified content nodes, or altered permissions in AEM audit logs following visits to crafted URLs.

Detection Strategies

Deploy Content Security Policy (CSP) reporting endpoints to capture blocked inline script executions and violation reports.
Inspect web server and reverse proxy access logs for URL patterns containing suspicious JavaScript keywords, encoded payloads, or excessive URL length in query strings and fragments.
Correlate authenticated AEM sessions with anomalous browser-originated API calls that deviate from typical user workflows.

Monitoring Recommendations

Enable and centralize AEM audit logs, dispatcher logs, and CSP violation reports in a SIEM for correlation.
Monitor for phishing campaigns referencing internal AEM hostnames and alert when employees click links to authoring environments from external sources.
Track browser telemetry from managed endpoints for script executions originating from the AEM origin that deviate from established baselines.

How to Mitigate CVE-2026-75712

Immediate Actions Required

Apply the security updates referenced in Adobe Security Advisory APSB26-98 to all AEM Cloud Service and AEM 6.5 LTS deployments.
Review authoring and publish instance access lists and remove unnecessary low-privilege accounts that could be leveraged as attack pivots.
Educate content authors and administrators about phishing lures containing AEM URLs with suspicious parameters.

Patch Information

Adobe released fixed builds addressed in security bulletin APSB26-98. Administrators running AEM Cloud Service receive updates through the managed service pipeline. On-premises AEM 6.5 LTS customers must upgrade to the fixed service pack level identified in the advisory. Consult the Adobe Security Advisory APSB26-98 for exact version guidance.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Configure the AEM Dispatcher to filter or reject requests containing suspicious query parameters and fragment payloads targeting known vulnerable endpoints.
Restrict access to AEM authoring interfaces to VPN or bastion hosts to reduce the exposure of authenticated users to attacker-controlled URLs.

bash

# Example Content Security Policy header for AEM responses
Content-Security-Policy: default-src 'self'; \
  script-src 'self' 'nonce-{RANDOM_NONCE}'; \
  object-src 'none'; \
  base-uri 'self'; \
  frame-ancestors 'self'; \
  report-uri /csp-violation-report