CVE-2026-75674: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75674 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the Document Object Model (DOM) environment to execute arbitrary JavaScript code within the victim's browser. This requires the victim to interact with a maliciously crafted webpage. The vulnerability changes the security scope and affects versions up to 2026.7.0, SP2, and 6.5.24. The CVSS 3.1 base score is 5.4, indicating medium severity with network attack vector, low attack complexity, low privileges required, and user interaction necessary. Confidentiality and integrity impacts are low, with no availability impact.

Successful exploitation could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to information disclosure or manipulation of client-side data. The impact is limited to confidentiality and integrity with no availability impact. Exploitation requires user interaction, reducing the likelihood of automated attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe whether the service is managed and patched server-side. Until an official fix is available, users should exercise caution when interacting with untrusted web content and avoid visiting suspicious links.