CVE-2026-75722: Adobe Experience Manager XSS Vulnerability

CVE-2026-75722 Overview

CVE-2026-75722 is a DOM-based Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Adobe Experience Manager (AEM). An attacker manipulates the client-side DOM environment to execute malicious JavaScript within the context of a victim's browser session. Exploitation requires low-privileged authenticated access and user interaction, as the victim must visit a crafted webpage. The scope is changed, meaning the vulnerability can impact resources beyond the vulnerable component's security scope. Adobe published the fix in security bulletin APSB26-98.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, credential theft, or unauthorized actions against AEM content.

Affected Products

Adobe Experience Manager (on-premise and cloud releases prior to the APSB26-98 fix)
Adobe Experience Manager AEM Cloud Service
Adobe Experience Manager 6.5 LTS (including SP1 and SP2)

Discovery Timeline

2026-09-08 - CVE-2026-75722 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75722

Vulnerability Analysis

The vulnerability resides in client-side JavaScript within Adobe Experience Manager. Untrusted data flows into a DOM sink such as innerHTML, document.write, or eval without proper sanitization or output encoding. When a victim loads a crafted URL or interacts with attacker-controlled content, the browser parses the tainted payload and executes injected script in the AEM origin's security context.

Because the CVSS scope is changed, executed script can reach content beyond the immediate component boundary. This includes authoring sessions, preview environments, and administrative interfaces reachable from the compromised context. The attack requires an authenticated session with low privileges, which aligns with AEM's authoring and content-contributor role model.

Root Cause

The root cause is improper neutralization of input during web page generation on the client side [CWE-79]. AEM's client-side scripts consume attacker-influenced values, such as URL fragments or query parameters, and write them into the DOM without contextual output encoding. The absence of a strict Content Security Policy and DOM-safe API usage allows the injected payload to execute.

Attack Vector

An attacker with a low-privileged AEM account crafts a URL or webpage containing a malicious JavaScript payload embedded in a DOM-controlled parameter. The attacker delivers the link through phishing, chat, or embedded content. When the victim clicks the link and their browser processes the tainted DOM data, the payload executes with the victim's AEM privileges. The attacker can exfiltrate session tokens, submit unauthorized content changes, or pivot to reach cross-origin resources accessible from the AEM authoring interface.

No public proof-of-concept exploit is available at the time of publication. Refer to the Adobe Security Advisory APSB26-98 for vendor-supplied technical guidance.

Detection Methods for CVE-2026-75722

Indicators of Compromise

AEM access logs showing requests with suspicious URL fragments, query parameters, or hash values containing HTML tags, javascript: URIs, or encoded <script> payloads
Outbound HTTP requests from authoring-user browsers to unfamiliar domains shortly after loading AEM pages
Unexpected content modifications, page publications, or user role changes originating from legitimate AEM accounts

Detection Strategies

Deploy Content Security Policy (CSP) reporting to capture script-src violations in AEM authoring and publish tiers
Inspect web application firewall (WAF) logs for reflected payloads in request URIs, referrers, and POST bodies targeting AEM endpoints
Correlate AEM audit logs with browser telemetry to identify sessions where DOM sinks receive attacker-controlled data

Monitoring Recommendations

Ingest AEM application, dispatcher, and access logs into a centralized analytics platform for continuous review
Alert on anomalous JavaScript execution patterns, unexpected cross-origin fetches, or authoring account activity from atypical geolocations
Track user-agent and referrer anomalies for accounts with content-authoring privileges

How to Mitigate CVE-2026-75722

Immediate Actions Required

Apply the Adobe security update referenced in bulletin APSB26-98 to all AEM on-premise and Cloud Service deployments
Audit AEM user accounts and revoke unnecessary authoring or administrative privileges to reduce exposure
Rotate active session tokens and credentials for privileged AEM users following patch deployment

Patch Information

Adobe released the fix in security bulletin APSB26-98. Administrators should apply the update to Adobe Experience Manager Cloud Service and Adobe Experience Manager 6.5 LTS, including Service Pack 1 and Service Pack 2. Consult the Adobe Security Advisory APSB26-98 for the specific fixed versions and installation procedures.

Workarounds

Enforce a strict Content Security Policy on AEM authoring hosts to block inline script execution and untrusted script sources
Restrict AEM authoring interface access to trusted networks or VPN endpoints while patch rollout is in progress
Train content authors to avoid clicking untrusted links while authenticated to AEM authoring sessions

bash

# Example CSP header for AEM dispatcher configuration
/response_headers {
  /0 { /type "Header"
       /method "always set"
       /header "Content-Security-Policy"
       /value "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report"
  }
}