CVE-2026-75668: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75668 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the DOM environment to execute arbitrary JavaScript code within the victim's browser context. Successful exploitation requires that the victim user interacts by visiting a maliciously crafted webpage. The vulnerability changes the security scope and affects multiple versions of the product. The CVSS 3.1 base score is 5.4, reflecting medium severity with network attack vector, low attack complexity, low privileges required, and user interaction needed. Confidentiality and integrity impacts are low, with no availability impact.

If exploited, this vulnerability allows execution of malicious scripts in the victim's browser, potentially leading to unauthorized actions or data exposure within the context of the affected application. However, exploitation requires user interaction (visiting a crafted webpage), and the impact on confidentiality and integrity is limited. There is no impact on availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe may manage remediation server-side; verify with Adobe's official advisory. Until a patch or official fix is available, users should exercise caution with untrusted links and avoid visiting suspicious webpages. No specific vendor mitigation instructions are provided in the input data.