CVE-2026-75725: Adobe Experience Manager XSS Vulnerability

CVE-2026-75725 Overview

Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-75725. An attacker can manipulate the DOM environment to execute malicious JavaScript in the context of a victim's browser. Exploitation requires user interaction, specifically that the victim visits a crafted webpage. The issue affects both AEM Cloud Service and AEM 6.5 LTS releases including service packs SP1 and SP2. The vulnerability is classified under [CWE-79] and results in a scope change, meaning the impact extends beyond the vulnerable component.

Critical Impact
Successful exploitation allows attackers to run arbitrary JavaScript in a victim's session, enabling session data theft, unauthorized actions, and content manipulation across trust boundaries.

Affected Products

Adobe Experience Manager Cloud Service (AEM as a Cloud Service)
Adobe Experience Manager 6.5 LTS (base release)
Adobe Experience Manager 6.5 LTS SP1 and SP2

Discovery Timeline

2026-09-08 - CVE-2026-75725 published to the National Vulnerability Database
2026-09-08 - Adobe publishes security advisory APSB26-98
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-75725

Vulnerability Analysis

CVE-2026-75725 is a DOM-based XSS flaw in Adobe Experience Manager. The vulnerability arises when client-side JavaScript writes attacker-controlled data into the Document Object Model without proper sanitization or output encoding. Unlike reflected or stored XSS, the malicious payload does not need to touch the server to execute. The scope change indicated in the CVSS vector means code executing through the flaw can affect resources beyond the AEM component itself, such as parent frames, adjacent applications, or authenticated user sessions on the same origin.

The vulnerability requires low privileges and user interaction. An authenticated user must be lured to a crafted URL or page that triggers the vulnerable client-side sink. Confidentiality and integrity impacts are limited, and there is no direct availability impact.

Root Cause

The underlying weakness maps to [CWE-79], Improper Neutralization of Input During Web Page Generation. In DOM-based variants, a JavaScript source such as location.hash, document.URL, or window.name flows into a dangerous sink like innerHTML, document.write, or eval without contextual escaping. Adobe has not published the specific sink or code path in the public advisory APSB26-98.

Attack Vector

The attack is delivered over the network and requires a victim to visit an attacker-crafted webpage or click a malicious link that targets an AEM author or publish endpoint. Once the DOM sink processes the payload, JavaScript executes in the victim's browser under the AEM origin. Attackers can use this to exfiltrate session tokens, invoke authenticated AEM APIs on behalf of the victim, alter rendered content, or pivot to further browser-based attacks.

No public proof-of-concept, exploit code, or exploitation in the wild has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-75725

Indicators of Compromise

Unusual URL parameters, fragments, or hash values targeting AEM author or publish nodes that contain HTML tags, javascript: schemes, or encoded script payloads.
Browser console errors or Content Security Policy (CSP) violations originating from AEM-served pages that reference inline or third-party scripts.
Unexpected outbound requests from AEM user browsers to attacker-controlled domains carrying session cookies or CSRF tokens.

Detection Strategies

Inspect web server and reverse proxy logs for requests to AEM paths containing suspicious query strings, fragments, or encoded <script>, onerror, or onload patterns.
Deploy a strict Content Security Policy on AEM endpoints and monitor report-uri or report-to submissions for blocked script executions.
Correlate AEM authentication events with anomalous client-side activity such as rapid API calls initiated from a user session shortly after a page load.

Monitoring Recommendations

Ingest AEM Dispatcher, web server, and CDN logs into a centralized analytics platform to baseline normal parameter and fragment usage.
Enable browser telemetry and CSP violation reporting for AEM domains to surface DOM sink executions in near real time.
Alert on new referrers or campaigns delivering AEM URLs with encoded payloads in the fragment or query string.

How to Mitigate CVE-2026-75725

Immediate Actions Required

Review Adobe Security Bulletin APSB26-98 and identify all AEM Cloud Service and AEM 6.5 LTS instances in scope.
Apply the vendor-provided updates to AEM 6.5 LTS deployments; AEM as a Cloud Service tenants receive the fix through the managed update channel.
Restrict AEM author interfaces to trusted networks and enforce authentication on any exposed publish endpoints.

Patch Information

Adobe has released fixes for affected AEM versions. Refer to the Adobe Security Advisory APSB26-98 for exact fixed versions, service pack levels, and cloud release identifiers. Cloud Service customers should confirm their environment is on the current release; AEM 6.5 LTS operators must install the specified service pack or hotfix.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources on AEM-rendered pages.
Configure the AEM Dispatcher to filter or reject requests containing suspicious characters in query parameters and URL fragments where feasible.
Educate content authors and administrators to avoid clicking untrusted links that reference AEM hostnames while authenticated.

bash

# Example Dispatcher filter to block obvious script payloads in query strings
# /etc/httpd/conf.dispatcher.d/filters/filters.any
/0100 { /type "deny" /url '*<script*' }
/0101 { /type "deny" /url '*javascript:*' }
/0102 { /type "deny" /url '*onerror=*' }