CVE-2026-75644: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75644 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager as a Cloud Service. It allows an attacker with low privileges to inject malicious JavaScript into form fields that are not properly sanitized. When other users visit the affected pages, the injected script executes in their browsers, potentially leading to information disclosure or session hijacking. The vulnerability affects versions up to 2026.7.0, SP2, and 6.5.24. The scope of the vulnerability is changed, indicating that the impact extends beyond the initially vulnerable component.

The vulnerability allows execution of malicious scripts in the context of a victim's browser, which can lead to limited confidentiality and integrity impacts, such as theft of user data or session tokens. There is no impact on availability. The attacker requires low privileges and user interaction is required to trigger the script execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if the service is patched server-side. Until a patch is confirmed, restrict access to vulnerable form fields and apply input validation or output encoding as temporary mitigations.