CVE-2026-75692: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75692 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the DOM environment to execute malicious scripts within the victim's browser. The attack requires the victim to visit a maliciously crafted webpage, and the scope of the vulnerability is changed. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, with low confidentiality and integrity impact and no availability impact.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to information disclosure or manipulation of the user interface. However, exploitation requires user interaction (visiting a crafted webpage). The impact on confidentiality and integrity is low, and there is no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe may manage remediation server-side; verify with Adobe's official advisory. Until a fix is confirmed, users should exercise caution when interacting with untrusted links or webpages.