CVE-2026-75724: Adobe Experience Manager XSS Vulnerability

CVE-2026-75724 Overview

CVE-2026-75724 is a DOM-based Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Adobe Experience Manager (AEM). An attacker can manipulate the Document Object Model (DOM) environment to execute arbitrary JavaScript within the context of a victim's browser session. Exploitation requires user interaction: the victim must visit a crafted webpage while authenticated to the AEM application. The vulnerability has a changed scope, meaning executed script can affect resources beyond the vulnerable component.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser, potentially leading to session compromise, credential theft, and unauthorized actions within the AEM environment.

Affected Products

Adobe Experience Manager (AEM Cloud Service) — all versions up to the patched release
Adobe Experience Manager 6.5 LTS (including SP1 and SP2)
Adobe Experience Manager on-premise deployments

Discovery Timeline

2026-09-08 - CVE-2026-75724 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75724

Vulnerability Analysis

The vulnerability resides in client-side JavaScript within Adobe Experience Manager that processes attacker-controllable input without proper sanitization before writing it to the DOM. Because the injection occurs entirely within the browser, the malicious payload never traverses the server, which limits server-side detection opportunities.

The changed scope indicates that script execution can affect data or components outside the security authority of the vulnerable component. Combined with the requirement for low-privilege authentication and user interaction, exploitation typically involves social engineering to lure an authenticated AEM user into loading a crafted URL or page.

The potential impact includes theft of session tokens, execution of privileged actions on behalf of the victim, defacement of content within the AEM authoring interface, and pivoting into further attacks against the AEM instance.

Root Cause

The root cause is improper neutralization of input used in DOM operations, classified under [CWE-79]. AEM client-side code passes untrusted data into sinks such as innerHTML, document.write, or unsafe jQuery methods without contextual output encoding. Adobe has not published detailed technical information about the specific affected component; refer to the Adobe Security Advisory APSB26-98 for vendor guidance.

Attack Vector

An attacker crafts a URL or webpage containing a malicious payload that manipulates the DOM environment when loaded by an authenticated AEM user. The victim must actively visit the crafted resource, typically delivered through phishing, a compromised third-party site, or a malicious advertisement. Once triggered, the injected script executes with the privileges of the victim's AEM session.

No verified public exploit code is available for this vulnerability. Refer to the vendor advisory for authoritative technical details.

Detection Methods for CVE-2026-75724

Indicators of Compromise

Unexpected outbound HTTP requests from AEM author or publish nodes to attacker-controlled infrastructure originating from browser sessions
Anomalous JavaScript execution patterns in browser telemetry when accessing AEM URLs, particularly involving eval, innerHTML writes, or dynamic <script> injection
AEM audit log entries showing privileged actions performed shortly after users visit external links
Unusual URL parameters or fragment identifiers in AEM access logs that contain encoded JavaScript payloads

Detection Strategies

Deploy a web application firewall with rules that inspect query strings and fragments for common XSS payload patterns targeting AEM endpoints
Enable Content Security Policy (CSP) reporting to capture blocked inline script attempts and forward reports to a SIEM for correlation
Monitor browser-side error logs and CSP violation reports for signs of injected script execution

Monitoring Recommendations

Correlate AEM access logs with authentication events to identify sessions that visited suspicious URLs before performing sensitive operations
Alert on referer headers pointing to unknown external domains for authenticated AEM sessions
Track user-agent and geolocation anomalies across active AEM author sessions

How to Mitigate CVE-2026-75724

Immediate Actions Required

Apply the security updates referenced in Adobe Security Advisory APSB26-98 to all AEM Cloud Service, AEM 6.5 LTS, and on-premise deployments
Audit AEM user accounts and revoke unnecessary author or administrative privileges to reduce blast radius
Notify AEM users to avoid clicking untrusted links while authenticated to the platform

Patch Information

Adobe has released fixes addressed in the security bulletin APSB26-98. Customers using AEM as a Cloud Service should confirm they are running the current release version. On-premise and LTS customers must install the corresponding service pack or hotfix. Adobe rates the update priority in the advisory; consult it before scheduling deployment windows.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Restrict access to AEM author instances behind a VPN or IP allowlist to reduce exposure of authenticated sessions
Configure HTTP-only and SameSite=Strict cookie attributes on AEM session cookies to limit exploitation impact
Deploy a web application firewall in front of AEM instances with rules tuned to block reflected and DOM-based XSS payloads

bash

# Example nginx configuration adding a restrictive CSP header for AEM
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;