CVE-2026-71357: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-71357 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the Document Object Model (DOM) environment, causing malicious JavaScript to execute within the victim's browser. The attack requires the victim to interact by visiting a maliciously crafted webpage. The vulnerability changes the security scope, potentially allowing the attacker to impact the confidentiality and integrity of the affected system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, changed scope, and impacts on confidentiality and integrity but not availability.

Successful exploitation can lead to partial compromise of confidentiality and integrity within the victim's browser context, potentially allowing execution of arbitrary scripts. However, exploitation requires user interaction (visiting a crafted webpage). There is no indication of availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe may manage remediation server-side; users should verify with Adobe's official advisories. Until a fix is confirmed, users should exercise caution with untrusted links and ensure browser security settings are up to date.