CVE-2026-75717: Adobe Experience Manager XSS Vulnerability

CVE-2026-75717 Overview

CVE-2026-75717 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM). Attackers can manipulate the Document Object Model (DOM) to execute arbitrary JavaScript in the victim's browser context. Exploitation requires user interaction, specifically that a victim visits a crafted webpage. The vulnerability carries a changed scope, meaning the impact extends beyond the vulnerable component. Adobe published fix guidance in security advisory APSB26-98.

Critical Impact
Successful exploitation allows attackers to execute malicious JavaScript in the victim's browser, potentially hijacking authenticated sessions or defacing content across AEM-hosted properties.

Affected Products

Adobe Experience Manager (on-premise release line)
Adobe Experience Manager Cloud Service (aem_cloud_service)
Adobe Experience Manager 6.5 LTS, including SP1 and SP2

Discovery Timeline

2026-09-08 - CVE-2026-75717 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75717

Vulnerability Analysis

The vulnerability is a DOM-based XSS flaw classified under CWE-79: Improper Neutralization of Input During Web Page Generation. Unlike reflected or stored XSS variants, DOM-based XSS occurs entirely within client-side JavaScript when untrusted data flows into a sink such as innerHTML, document.write, or eval without proper sanitization.

In AEM, client-side scripts render or process data from URL fragments, query parameters, or other DOM sources. When these inputs reach a dangerous sink unsanitized, attacker-controlled markup executes in the victim's browser under the AEM origin. The changed scope indicates the injected script can affect resources beyond the vulnerable component itself, including authenticated author or publish sessions.

Root Cause

The root cause is missing or insufficient output encoding of attacker-controlled DOM inputs in Adobe Experience Manager client-side code. Data flowing from an untrusted source into an HTML or JavaScript execution sink is not neutralized, permitting arbitrary script execution.

Attack Vector

The attack vector is network-based with low complexity but requires low-privilege authentication and user interaction. An authenticated attacker crafts a URL or webpage containing a malicious payload. When a victim with an active AEM session visits the crafted page, the payload executes in their browser, allowing session data theft, DOM manipulation, or actions performed on the victim's behalf. Because scope is changed, the payload can reach resources outside the initially vulnerable security context.

No public proof-of-concept exploit is currently available. See the Adobe Security Advisory APSB26-98 for vendor-provided technical context.

Detection Methods for CVE-2026-75717

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event handler attributes (onerror, onload) present in AEM request parameters or URL fragments.
Outbound browser requests from authenticated AEM sessions to unfamiliar external hosts, indicating potential session data exfiltration.
Anomalous DOM mutations in AEM author or publish instances captured by browser telemetry or client-side monitoring.

Detection Strategies

Inspect web server and reverse proxy logs for requests containing encoded XSS payloads targeting AEM endpoints and dispatcher paths.
Deploy Content Security Policy (CSP) reporting to surface script-source violations that indicate exploitation attempts.
Correlate authenticated AEM user activity with subsequent unusual API calls or content modifications made from the same session.

Monitoring Recommendations

Enable verbose access logging on AEM dispatcher and publish tiers, retaining full URLs and referrers for forensic review.
Monitor for privilege changes, package installations, or unexpected content edits following user visits to external links.
Integrate AEM access logs into a centralized SIEM to enable cross-source correlation and alerting on XSS-indicative patterns.

How to Mitigate CVE-2026-75717

Immediate Actions Required

Apply the security updates referenced in Adobe Security Advisory APSB26-98 to all affected AEM instances, including 6.5 LTS deployments and Cloud Service tenants.
Audit AEM user accounts and revoke unused low-privilege author accounts that could be leveraged to stage the required authenticated request.
Instruct AEM authors and administrators to avoid clicking untrusted links while logged into AEM author or publish environments.

Patch Information

Adobe has released fixed versions as documented in advisory APSB26-98. Customers on Adobe Experience Manager Cloud Service receive updates automatically through the managed release channel. On-premise and LTS customers must upgrade to the fixed service pack or cumulative fix pack identified in the advisory. Verify remediation by validating build versions after deployment.

Workarounds

Enforce a strict Content Security Policy that blocks inline scripts and restricts script sources to trusted origins, reducing XSS execution surface.
Configure the AEM dispatcher to filter or reject requests containing suspicious characters and script-like payloads in query parameters.
Require multi-factor authentication for all AEM author accounts to increase the cost of session abuse following successful XSS.

bash

# Example AEM dispatcher filter to block script-injection patterns in query strings
/filter {
  /0100 { /type "deny" /url "*<script*" }
  /0101 { /type "deny" /url "*javascript:*" }
  /0102 { /type "deny" /url "*onerror=*" }
  /0103 { /type "deny" /url "*onload=*" }
}