CVE-2026-75696: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75696 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the Document Object Model (DOM) environment to execute arbitrary JavaScript code within the victim's browser. This requires the victim to interact by visiting a maliciously crafted webpage. The vulnerability changes the scope, indicating that the impact crosses security boundaries. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, changed scope, and limited confidentiality and integrity impacts without availability impact.

Successful exploitation could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to limited confidentiality and integrity impacts such as theft or manipulation of sensitive information accessible to the browser session. The attack requires user interaction and low privileges, with the scope changed to indicate impact beyond the initial security boundary.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if the service is managed and patched server-side. Until an official fix is available, avoid visiting untrusted or suspicious links that could trigger the vulnerability.