CVE-2026-19479: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-19479 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the Document Object Model (DOM) environment to execute arbitrary JavaScript code within the context of a victim's browser. Exploitation requires the victim to interact by visiting a maliciously crafted webpage. The vulnerability affects versions up to and including 2026.7.0, SP2, and 6.5.24. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity. There is no indication of known exploits in the wild. The scope of the vulnerability is changed, meaning the impact crosses security boundaries.

Successful exploitation could lead to limited confidentiality and integrity impacts by executing malicious scripts in the victim's browser context. There is no impact on availability. The attack requires user interaction (visiting a crafted webpage). No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe whether the service is managed and patched server-side. Until a fix is applied, avoid visiting untrusted links and ensure user awareness of phishing attempts. Monitor Adobe's official advisories for updates on patches or mitigations.