CVE-2026-75646: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75646 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. The flaw allows attackers to execute arbitrary JavaScript by manipulating the Document Object Model (DOM) in the victim's browser. Successful exploitation requires the victim to interact with a maliciously crafted webpage. The vulnerability impacts confidentiality and integrity but does not affect availability. It affects versions up to and including 2026.7.0, SP2, and 6.5.24. No known exploits are reported in the wild, and no official patch or remediation details are provided in the input data.

The vulnerability can lead to the execution of malicious scripts in the context of the victim's browser, potentially compromising confidentiality and integrity of user data. It requires user interaction, limiting the attack vector to scenarios where users visit a malicious webpage. There is no reported impact on system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if server-side patches have been applied. Until an official fix is available, limit exposure by educating users to avoid clicking on suspicious links and consider implementing Content Security Policy (CSP) headers to mitigate DOM-based XSS risks.