CVE-2026-71356: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-71356 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the Document Object Model (DOM) environment to execute arbitrary JavaScript code within the victim's browser. This requires the victim to interact by visiting a maliciously crafted webpage. The vulnerability affects confidentiality and integrity with no impact on availability. The scope of the vulnerability is changed, indicating that the vulnerability affects resources beyond the initially intended security scope.

Successful exploitation could lead to execution of attacker-controlled scripts in the context of the victim's browser, potentially allowing theft of sensitive information or manipulation of web content. The impact is limited to confidentiality and integrity, with no reported impact on availability. User interaction is required for exploitation, reducing the likelihood of automated attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe may manage remediation server-side; verify with Adobe's official advisory. Until a fix is confirmed, users should exercise caution when interacting with untrusted links or webpages.