CVE-2026-75666: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75666 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this vulnerability by manipulating the Document Object Model (DOM) environment, causing malicious JavaScript to execute within the context of the victim's browser. Successful exploitation requires the victim to interact by visiting a specially crafted webpage. The vulnerability affects versions up to and including 2026.7.0, SP2, and 6.5.24. The CVSS 3.1 base score is 5.4 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, user interaction required, changed scope, and limited confidentiality and integrity impact without availability impact.

An attacker exploiting this DOM-based XSS vulnerability can execute arbitrary JavaScript in the context of the victim's browser, potentially leading to limited confidentiality and integrity impacts. The attack requires user interaction, limiting the scope of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if remediation is managed server-side. Until an official fix is available, users should be cautious about visiting untrusted or suspicious webpages that could trigger the vulnerability.