CVE-2026-75636: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75636 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. The flaw allows attackers to execute arbitrary JavaScript by manipulating the Document Object Model (DOM) in the victim's browser. Successful exploitation requires the victim to interact with a maliciously crafted webpage. The vulnerability impacts confidentiality and integrity but does not affect availability. The scope of the vulnerability is changed, indicating that the impact crosses security boundaries. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, changed scope, and partial confidentiality and integrity impact.

An attacker exploiting this vulnerability can execute malicious scripts in the context of the victim's browser, potentially leading to partial disclosure of confidential information and modification of data accessible to the browser session. The attack requires user interaction, limiting automatic exploitation. There is no impact on system availability. The vulnerability affects confidentiality and integrity with changed scope, meaning the attack can cross security boundaries within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe typically manages remediation server-side. Users should monitor Adobe's official advisories for updates and apply any patches or mitigations provided. Until a fix is confirmed, users should exercise caution when interacting with untrusted content and ensure that security controls such as Content Security Policy (CSP) are in place to mitigate XSS risks.