CVE-2026-75678: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75678 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the Document Object Model (DOM) environment to execute arbitrary JavaScript code within the victim's browser context. Successful exploitation requires the victim to interact by visiting a maliciously crafted webpage. The vulnerability changes the security scope and affects multiple versions of the product.

Exploitation of this vulnerability could lead to the execution of arbitrary JavaScript in the victim's browser, potentially allowing an attacker to perform actions such as stealing session tokens or manipulating the user interface. The impact is limited by the requirement for user interaction and the medium severity score (CVSS 5.4). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if the service is managed and patched server-side. Until an official fix is available, limit exposure by educating users about the risks of visiting untrusted links and consider implementing Content Security Policy (CSP) headers to mitigate DOM-based XSS risks.