CVE-2026-75691: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75691 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the DOM environment to execute arbitrary JavaScript code within the victim's browser. Exploitation requires the victim to visit a maliciously crafted webpage, and the scope of the vulnerability is changed. The vulnerability affects versions up to and including 2026.7.0, SP2, and 6.5.24. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, changed scope, and limited confidentiality and integrity impact.

Successful exploitation can lead to execution of arbitrary JavaScript in the context of the victim's browser, potentially allowing data theft or session hijacking. The impact is limited to confidentiality and integrity with no availability impact. User interaction is required, reducing the likelihood of automated exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe whether the service is patched server-side. Until a fix is confirmed, users should exercise caution with untrusted links and crafted webpages. No official fix or patch links are currently provided.