CVE-2026-75667: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75667 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. The flaw allows attackers to execute arbitrary JavaScript by manipulating the Document Object Model (DOM) in the victim's browser. Successful exploitation depends on the victim interacting with a maliciously crafted webpage. The vulnerability affects versions up to and including 2026.7.0, SP2, and 6.5.24. The scope of the vulnerability is changed, indicating that the impact extends beyond the vulnerable component itself.

An attacker exploiting this vulnerability can execute malicious JavaScript code within the context of the victim's browser, potentially leading to information disclosure and integrity impacts. The vulnerability requires user interaction, limiting the attack vector to scenarios where the victim visits a malicious webpage. There is no indication of availability impact. The scope change suggests the vulnerability affects components beyond the initially vulnerable code.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if the service has been patched or if mitigation is managed server-side. Until an official fix is available, avoid visiting untrusted or suspicious webpages and consider applying any recommended configuration changes from Adobe advisories.