CVE-2026-75719: Adobe Experience Manager XSS Vulnerability

CVE-2026-75719 Overview

CVE-2026-75719 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM). An attacker can manipulate the Document Object Model (DOM) environment to execute malicious JavaScript within the victim's browser context. Exploitation requires that an authenticated user visit a crafted webpage, and the vulnerability carries a changed scope, allowing impact beyond the vulnerable component. The weakness is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation lets attackers execute arbitrary JavaScript in a victim's authenticated AEM session, enabling session data theft, unauthorized actions, or content manipulation across trust boundaries.

Affected Products

Adobe Experience Manager (AEM Cloud Service)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS Service Pack 1 and Service Pack 2

Discovery Timeline

2026-09-08 - CVE-2026-75719 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75719

Vulnerability Analysis

The flaw is a client-side DOM-based XSS in Adobe Experience Manager. Client-side JavaScript within AEM consumes attacker-influenced input from the DOM without sufficient sanitization or output encoding. When a victim visits a crafted page, the tainted data flows into a sink that executes JavaScript in the origin of the AEM application.

Because the CVSS scope is Changed, code executed via this sink can affect resources beyond the vulnerable component's security authority. That behavior is characteristic of iframe, cross-origin, or privileged-context flows commonly seen in AEM authoring and preview surfaces. Exploitation requires a low-privileged authenticated user and user interaction to trigger the crafted page.

Root Cause

The root cause is missing or insufficient neutralization of untrusted input inside client-side JavaScript executed by AEM ([CWE-79]). A source such as document.location, document.referrer, or a window.name value reaches a dangerous DOM sink (for example, innerHTML, document.write, or eval) without contextual encoding. The scope change indicates the executing script can influence a security context different from the one that parsed the input.

Attack Vector

Exploitation follows a network-based social engineering chain. The attacker crafts a URL or hosts a page that seeds a malicious payload into a DOM property the AEM client script reads. When an authenticated AEM user with low privileges loads the page, the vulnerable script writes the payload into a JavaScript execution sink, running the attacker's code in the AEM origin. The attacker can then read session-bound data, issue authenticated requests, or manipulate rendered content. Full technical details are available in the Adobe Security Advisory APSB26-98.

Detection Methods for CVE-2026-75719

Indicators of Compromise

Unexpected <script> tags, event handlers, or javascript: URIs rendered inside AEM author or publish responses.
HTTP requests to AEM containing suspicious fragment identifiers or query parameters carrying encoded HTML or JavaScript payloads.
Outbound browser requests from AEM users to unfamiliar domains shortly after loading AEM URLs with unusual fragments.

Detection Strategies

Inspect web server and CDN logs for AEM URLs containing DOM XSS indicators such as #, onerror=, onload=, or <script> sequences in fragments or parameters.
Enable a Content Security Policy (CSP) report-only mode to surface inline script violations originating from AEM pages.
Correlate authenticated AEM sessions with anomalous JavaScript-initiated API calls to /bin/, /libs/, or /content/ endpoints.

Monitoring Recommendations

Monitor AEM dispatcher and access logs for repeated requests carrying script-like tokens targeting authoring endpoints.
Alert on new or unusual referrers directing authenticated users to AEM login or preview URLs.
Track browser-side CSP violation reports and Web Application Firewall (WAF) blocks associated with AEM hosts.

How to Mitigate CVE-2026-75719

Immediate Actions Required

Apply the Adobe security update referenced in APSB26-98 to AEM Cloud Service and AEM 6.5 LTS instances.
Restrict access to AEM author instances to trusted networks and verified users until patching completes.
Instruct AEM users to avoid clicking untrusted links while authenticated to author or publish environments.

Patch Information

Adobe published fixes for Adobe Experience Manager Cloud Service and AEM 6.5 LTS (including Service Pack 1 and Service Pack 2) in Adobe Security Bulletin APSB26-98. Administrators should upgrade to the fixed release listed in the advisory. AEM Cloud Service customers on the current release channel receive the fix through Adobe's managed update pipeline.

Workarounds

Deploy a strict Content Security Policy (CSP) that disallows inline scripts and untrusted script sources on AEM domains.
Configure the AEM Dispatcher and any upstream WAF to filter request parameters and fragments containing HTML or JavaScript tokens.
Enforce short session lifetimes and re-authentication for privileged AEM operations to reduce the window for session-riding exploitation.

bash

# Example: restrictive CSP header for AEM responses (dispatcher or CDN)
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"