CVE-2026-75661: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75661 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the Document Object Model (DOM) to execute arbitrary JavaScript code in the context of a user's browser. This requires the victim to interact with a maliciously crafted webpage. The vulnerability affects versions up to and including 2026.7.0, SP2, and 6.5.24. The scope of the vulnerability is changed, and the CVSS v3.1 base score is 5.4 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Successful exploitation could lead to partial confidentiality and integrity impacts by executing malicious scripts in the victim's browser, potentially allowing theft of sensitive information or manipulation of the user interface. There is no impact on availability. The attack requires user interaction and privileges at the level of a user with limited privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is not a cloud-hosted service, remediation depends on vendor patches or updates. Users should monitor Adobe's official advisories for patches or workarounds. Until a fix is available, avoid visiting untrusted or suspicious links that could exploit this vulnerability.