CVE-2026-75695: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75695 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this vulnerability by manipulating the Document Object Model (DOM) environment to execute arbitrary JavaScript code within the victim's browser context. Successful exploitation requires the victim to interact by visiting a specially crafted webpage. The vulnerability changes the scope of impact and is rated medium severity with a CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

The vulnerability allows an attacker to execute malicious JavaScript in the victim's browser, potentially leading to limited confidentiality and integrity impacts. The attack requires user interaction and privileges, and the scope is changed, indicating that the vulnerability affects components beyond the initially vulnerable code. There is no indication of availability impact or known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if the service is managed and patched server-side. Until an official fix is available, avoid interacting with untrusted or suspicious links that could trigger the vulnerability.