CVE-2026-71565: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-71565 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. It enables an attacker to execute arbitrary JavaScript by manipulating the Document Object Model (DOM) in the victim's browser. The attack requires the victim to visit a maliciously crafted webpage. The vulnerability affects versions up to and including 2026.7.0, SP2, and 6.5.24. The CVSS v3.1 base score is 5.4 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, user interaction required, changed scope, and low confidentiality and integrity impact with no availability impact.

Successful exploitation can lead to execution of malicious JavaScript in the context of the victim's browser, potentially allowing an attacker to steal sensitive information or perform actions on behalf of the user. The impact is limited by the requirement for user interaction and the need for the victim to visit a crafted webpage. The vulnerability affects confidentiality and integrity to a limited extent but does not impact availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if the service is managed and patched server-side. Until an official fix is available, users should be cautious about visiting untrusted or suspicious links. No specific vendor advisory or patch links are provided at this time.