CVE-2026-75720: Adobe Experience Manager XSS Vulnerability

CVE-2026-75720 Overview

Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-75720. An attacker can manipulate the client-side Document Object Model (DOM) to execute arbitrary JavaScript in the victim's browser session. Exploitation requires low-privilege authentication and user interaction — the victim must visit a crafted webpage. The vulnerability has a changed scope, meaning code execution affects resources beyond the vulnerable component. This flaw is categorized under [CWE-79]: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute malicious JavaScript in the context of authenticated AEM users, enabling session hijacking, credential theft, and unauthorized actions within the AEM environment.

Affected Products

Adobe Experience Manager (AEM Cloud Service)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS Service Pack 1 and Service Pack 2

Discovery Timeline

2026-09-08 - CVE-2026-75720 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75720

Vulnerability Analysis

CVE-2026-75720 is a DOM-based XSS vulnerability in Adobe Experience Manager. Unlike reflected or stored XSS, DOM-based XSS occurs entirely on the client side. The vulnerable JavaScript reads attacker-controlled data from a DOM source such as document.location, document.URL, or document.referrer and passes it to a dangerous sink such as innerHTML, document.write, or eval without proper sanitization.

The attacker requires low-level privileges within the AEM environment. The victim must interact with a specifically crafted webpage or URL. Because the scope is changed, the injected script can affect resources beyond the vulnerable component, extending the blast radius to other browser-accessible assets under the same authenticated session.

Root Cause

The root cause is improper neutralization of user-controllable input in client-side JavaScript. AEM code paths accept untrusted data from DOM sources and inject it into HTML sinks without contextual output encoding or safe DOM manipulation APIs. This allows arbitrary HTML and JavaScript to be parsed and executed by the browser.

Attack Vector

Exploitation follows a network-based vector with user interaction. An attacker crafts a URL containing a malicious payload in a fragment, query parameter, or other DOM-accessible source. The attacker delivers the URL through phishing, chat, or an embedded link on a controlled page. When an authenticated AEM user opens the link, the vulnerable client-side script processes the payload and injects it into the DOM. The browser executes the injected JavaScript with the user's AEM session context.

No verified public exploit or proof-of-concept code is available. Refer to the Adobe Security Advisory APSB26-98 for vendor-specific technical details.

Detection Methods for CVE-2026-75720

Indicators of Compromise

Unusual URL parameters, fragments, or hash values in AEM web server access logs containing HTML tags, JavaScript keywords, or encoded payloads such as %3Cscript%3E.
Unexpected outbound requests from authenticated AEM user sessions to attacker-controlled domains, indicating data exfiltration via injected script.
Anomalous authoring or content changes performed by AEM users shortly after clicking external links.

Detection Strategies

Deploy Content Security Policy (CSP) reporting to capture inline script violations and unexpected script sources referencing AEM origins.
Inspect HTTP referer headers and request patterns for AEM authors visiting crafted third-party pages immediately before suspicious activity.
Correlate browser telemetry with AEM audit logs to detect session actions performed without explicit user intent.

Monitoring Recommendations

Enable and centralize AEM access logs, dispatcher logs, and authoring audit trails for continuous review.
Monitor authenticated session behavior for privilege changes, content publishing, or credential access initiated shortly after external navigation events.
Alert on browser-based security violations reported via CSP endpoints tied to AEM domains.

How to Mitigate CVE-2026-75720

Immediate Actions Required

Apply the security update referenced in the Adobe Security Advisory APSB26-98 to all affected AEM Cloud Service and AEM 6.5 LTS deployments.
Restrict AEM author instances to trusted networks and require VPN or zero-trust access to reduce exposure to phishing-delivered payloads.
Educate AEM authors and administrators about the risk of clicking untrusted links while authenticated to AEM.

Patch Information

Adobe has released fixed versions for Adobe Experience Manager as documented in security bulletin APSB26-98. Customers running AEM Cloud Service should confirm they are on the latest release channel. AEM 6.5 LTS customers should upgrade to the patched Service Pack version identified in the advisory. Review the Adobe Security Advisory APSB26-98 for exact version numbers and download instructions.

Workarounds

Enforce a strict Content Security Policy on AEM domains to block inline scripts and restrict script sources to approved origins.
Configure the AEM dispatcher to filter suspicious query parameters, fragments, and characters commonly used in XSS payloads.
Require re-authentication for sensitive AEM operations to limit the impact of hijacked sessions.

bash

# Example: enforcing a restrictive Content Security Policy header on AEM responses
# Add to the AEM dispatcher or upstream web server configuration
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"