CVE-2026-19644: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-19644 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the Document Object Model (DOM) to execute arbitrary JavaScript code in the context of the victim's browser. This requires the victim to visit a maliciously crafted webpage. The vulnerability changes the security scope and affects multiple versions of the product. No known exploits are reported in the wild, and no patch or remediation details are provided in the input data.

Successful exploitation could lead to partial confidentiality and integrity loss by executing malicious scripts in the victim's browser, potentially leading to session hijacking or unauthorized actions within the affected application context. Availability is not impacted. The attack requires user interaction, limiting the attack vector to social engineering or phishing scenarios.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if the service is patched server-side. Until an official fix is confirmed, avoid visiting untrusted links and consider applying any recommended workarounds from Adobe.