CVE-2026-75672: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75672 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the Document Object Model (DOM) environment to execute arbitrary JavaScript code within the victim's browser context. Successful exploitation requires the victim to interact by visiting a maliciously crafted webpage. The vulnerability affects versions up to 2026.7.0, SP2, and 6.5.24. The vulnerability changes the scope and has a CVSS 3.1 base score of 5.4 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

The vulnerability allows an attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to partial confidentiality and integrity impacts. There is no impact on availability. Exploitation requires user interaction and privileges at the low level. The scope is changed, meaning the vulnerability affects components beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if the service has been patched server-side. Until an official fix is confirmed, avoid visiting untrusted or suspicious links and ensure users are aware of the risk of interacting with crafted webpages.