CVE-2026-75690 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the Document Object Model (DOM) environment to execute arbitrary JavaScript code within the context of a victim's browser. This requires the victim to interact with a maliciously crafted webpage. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity), with network attack vector, low attack complexity, requiring low privileges and user interaction. The impact affects confidentiality and integrity with a changed scope, but no impact on availability is noted. No patch or official remediation level has been provided yet, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker to execute malicious scripts in the victim's browser, potentially leading to unauthorized disclosure or modification of information accessible to the browser session. There is no reported impact on system availability. The attack requires user interaction and low privileges, limiting the ease of exploitation. The changed scope indicates the vulnerability may affect components beyond the originally vulnerable code base.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe typically manages remediation server-side; however, no official fix or temporary mitigation has been announced. Users and administrators should monitor Adobe's official advisories for updates. Until a fix is available, caution should be exercised regarding user interaction with untrusted links or webpages related to this service.