CVE-2026-75715: Adobe Experience Manager XSS Vulnerability

CVE-2026-75715 Overview

CVE-2026-75715 is a DOM-based Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Adobe Experience Manager (AEM). An attacker can manipulate the client-side Document Object Model (DOM) to execute arbitrary JavaScript within a victim's browser session. Exploitation requires user interaction: the victim must visit an attacker-crafted webpage. The scope is changed, meaning executed script can affect resources beyond the vulnerable component's security boundary. Adobe published patch guidance in security advisory APSB26-98.

Critical Impact
Successful exploitation allows attackers to execute JavaScript in the victim's browser context, potentially leading to session token theft, content manipulation, or redirection to attacker-controlled resources within AEM-hosted applications.

Affected Products

Adobe Experience Manager Cloud Service (AEM CS)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS Service Pack 1 and Service Pack 2

Discovery Timeline

2026-09-08 - CVE-2026-75715 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75715

Vulnerability Analysis

The vulnerability resides in client-side JavaScript within Adobe Experience Manager that processes attacker-controllable input without proper sanitization before writing it into the DOM. When a victim loads a crafted URL or page that triggers the vulnerable code path, the untrusted data is interpreted as executable script by the browser. Because the scope is changed, the injected script can influence security-relevant resources outside the vulnerable component. Exploitation requires low privileges and user interaction, aligning with authenticated AEM author or content workflows commonly targeted in phishing scenarios.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79] at the client tier. Vulnerable JavaScript reads values from sources such as location.hash, location.search, document.referrer, or window.name, and passes them into dangerous sinks such as innerHTML, document.write, or eval without contextual output encoding. This allows an attacker to smuggle HTML or script content that the browser then parses and executes.

Attack Vector

An attacker crafts a URL pointing to a legitimate AEM instance that includes a malicious payload in a DOM-accessible location, such as the URL fragment. The attacker then delivers this URL through phishing, malicious advertisements, or a compromised third-party site. When an authenticated AEM user visits the link, the vulnerable client-side script parses the payload and injects it into the DOM. The browser executes the payload in the origin of the AEM application, granting the attacker access to session cookies, CSRF tokens, and authenticated API operations available to the victim.

No verified public proof-of-concept code is available at the time of publication. Refer to the Adobe Security Advisory APSB26-98 for vendor-provided technical guidance.

Detection Methods for CVE-2026-75715

Indicators of Compromise

Web server access logs containing requests with suspicious URL fragments or query parameters containing HTML tags, javascript: URIs, or encoded script payloads targeting AEM endpoints.
Unexpected outbound HTTP requests originating from authenticated author or publish sessions to attacker-controlled domains.
Anomalous creation, modification, or replication of AEM content nodes performed by users whose browsers loaded crafted URLs.

Detection Strategies

Deploy a Content Security Policy (CSP) in report-only mode to surface inline script executions and unauthorized script sources on AEM-hosted pages.
Inspect referrer and user-agent chains in AEM Dispatcher logs for authenticated sessions that arrived via external links carrying script-like tokens.
Correlate browser-side JavaScript errors and CSP violation reports with authenticated AEM user activity to identify targeted users.

Monitoring Recommendations

Alert on AEM administrative actions performed within seconds of a session loading an externally referred URL containing encoded characters.
Monitor for session cookie use from multiple IP addresses within short intervals, which may indicate token theft following XSS execution.
Baseline normal query string and fragment patterns for AEM URLs and flag statistical outliers for review.

How to Mitigate CVE-2026-75715

Immediate Actions Required

Apply the security updates referenced in Adobe Security Advisory APSB26-98 to all AEM Cloud Service and AEM 6.5 LTS instances.
Enforce a strict Content Security Policy on AEM author and publish tiers to limit the impact of script injection.
Educate AEM authors and administrators about phishing links that target authenticated sessions.

Patch Information

Adobe addressed CVE-2026-75715 through updates documented in advisory APSB26-98. Administrators of AEM Cloud Service should confirm their environment is running the latest release channel, and AEM 6.5 LTS operators should install the service pack or hotfix identified in the advisory for their base version, SP1, or SP2 deployment.

Workarounds

Restrict AEM author instance access to trusted networks or a VPN to reduce exposure of authenticated users to arbitrary external links.
Configure the AEM Dispatcher to filter or reject requests containing script-like patterns in query strings and fragments where feasible.
Enable browser features such as SameSite=Strict cookies and HttpOnly flags on AEM session cookies to limit token exfiltration.

bash

# Example Content Security Policy header for AEM Dispatcher (Apache httpd)
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report"
Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure;SameSite=Strict