CVE-2026-75677: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75677 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. It enables an attacker to execute arbitrary JavaScript by manipulating the Document Object Model (DOM) environment within the victim's browser. The attack requires the victim to interact by visiting a specially crafted webpage. The vulnerability impacts confidentiality and integrity with a changed scope, but does not affect availability. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, changed scope, and partial confidentiality and integrity impact.

Successful exploitation can lead to partial confidentiality and integrity compromise through execution of malicious scripts in the victim's browser context. This may allow theft of sensitive information or manipulation of client-side data. The attack requires user interaction and does not impact system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if the service is managed and patched server-side. Until a fix is confirmed, avoid visiting untrusted or suspicious links and ensure users are aware of the risk of interacting with unknown webpages.