CVE-2026-75683: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75683 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the Document Object Model (DOM) environment to execute arbitrary JavaScript code within the victim's browser. This requires the victim to visit a maliciously crafted webpage. The vulnerability changes the security scope and affects confidentiality and integrity with no impact on availability. The CVSS v3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

Successful exploitation can lead to partial compromise of confidentiality and integrity by executing malicious scripts in the context of the victim's browser. This could allow theft of sensitive information or manipulation of web content. Availability is not affected. Exploitation requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe whether the service is managed and patched server-side. Until an official fix is available, limit exposure by educating users to avoid clicking untrusted links and consider implementing Content Security Policy (CSP) headers if applicable.