CVE-2026-75691 is a DOM-based Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can manipulate the DOM environment to execute arbitrary JavaScript code within the victim's browser context. Exploitation requires the victim to interact by visiting a maliciously crafted webpage. The vulnerability affects the confidentiality and integrity of data with no impact on availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, changed scope, and partial confidentiality and integrity impact.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to partial disclosure and modification of data accessible to the user. There is no reported impact on system availability. The attack requires user interaction, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe whether the service has been updated or mitigated server-side. Until an official fix or mitigation is confirmed, users should be cautious about interacting with untrusted links or webpages.