CVE-2026-75657: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75657 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this vulnerability by manipulating the Document Object Model (DOM) environment to execute arbitrary JavaScript code within the victim's browser. This requires the victim to interact with a maliciously crafted webpage. The vulnerability changes the scope and impacts confidentiality and integrity with limited privileges and user interaction required. The CVSS vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low complexity, low privileges, required user interaction, changed scope, and limited confidentiality and integrity impact.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to limited confidentiality and integrity impacts. The attack requires user interaction and low privileges, limiting the scope of impact. There is no indication of availability impact or known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe whether remediation is managed server-side. Until a fix is confirmed, avoid visiting untrusted or suspicious links and ensure users are aware of potential phishing attempts involving crafted webpages.