CVE-2026-75694: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75694 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. This vulnerability allows an attacker to manipulate the DOM environment to execute arbitrary JavaScript code within the context of a victim's browser. Successful exploitation requires the victim to interact by visiting a maliciously crafted webpage. The vulnerability changes the security scope and affects multiple versions of the product. The CVSS v3.1 base score is 5.4, indicating medium severity with network attack vector, low attack complexity, low privileges required, user interaction needed, scope changed, and impacts on confidentiality and integrity but no impact on availability.

An attacker exploiting this vulnerability can execute arbitrary JavaScript code in the context of the victim's browser, potentially leading to information disclosure or manipulation of client-side data. The attack requires user interaction (visiting a crafted webpage). There is no indication of active exploitation in the wild. The impact affects confidentiality and integrity but not availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if the service is managed and patched server-side. Until an official fix is available, users should exercise caution with untrusted links and crafted webpages to avoid exploitation.