CVE-2026-75669: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75669 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the Document Object Model (DOM) environment, causing malicious JavaScript to execute within the victim's browser. The attack requires the victim to interact by visiting a maliciously crafted webpage. The vulnerability affects multiple versions of Adobe Experience Manager, including versions up to 2026.7.0, SP2, and 6.5.24. The scope of the vulnerability is changed, and the CVSS 3.1 base score is 5.4, reflecting a medium impact on confidentiality and integrity with no impact on availability.

Successful exploitation can lead to execution of arbitrary JavaScript in the context of the victim's browser, potentially exposing confidential information and allowing limited integrity violations. The vulnerability requires user interaction and network access. There is no indication of availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if the service is managed and patched server-side. Until an official fix is available, users should be cautious about visiting untrusted or suspicious webpages that could trigger the vulnerability.