CVE-2026-75643: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75643 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. It allows an attacker with low privileges to inject malicious JavaScript into vulnerable form fields. When other users browse pages containing these fields, the malicious scripts may execute in their browsers, potentially compromising confidentiality and integrity of data. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and partial impact on confidentiality and integrity. No known exploits in the wild have been reported. The affected versions include those up to and including 2026.7.0, SP2, and 6.5.24. Patch status is not confirmed in the provided data.

The vulnerability allows execution of malicious scripts in the context of users' browsers, potentially leading to unauthorized disclosure and modification of information (confidentiality and integrity impacts). There is no impact on availability. The scope change indicates that the vulnerability may affect components beyond the initially vulnerable scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a stored XSS vulnerability, users should monitor Adobe's official advisories for patches or updates. Until a fix is available, consider restricting access to vulnerable form fields or applying input validation and output encoding as temporary mitigations if feasible.