CVE-2026-75652: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75652 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the Document Object Model (DOM) environment, causing malicious JavaScript to execute within the victim's browser. The attack requires the victim to interact by visiting a specially crafted webpage. The vulnerability changes the security scope and affects versions up to 2026.7.0, SP2, and 6.5.24. The CVSS 3.1 base score is 5.4, with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, privileges required, user interaction required, changed scope, and low impact on confidentiality and integrity.

Successful exploitation could lead to execution of arbitrary JavaScript in the context of the victim's browser, potentially allowing an attacker to steal sensitive information or perform actions on behalf of the user. The impact is limited to confidentiality and integrity with no impact on availability. The vulnerability requires user interaction and privileges, reducing the likelihood of widespread exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe may manage remediation server-side; verify with Adobe's official advisory. Until a fix is confirmed, users should exercise caution when interacting with untrusted links or webpages. No official patch links are provided in the current data.