CVE-2026-75701: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75701 describes a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this vulnerability by manipulating the Document Object Model (DOM) environment, causing malicious JavaScript to execute within the victim's browser context. The attack requires the victim to interact by visiting a specially crafted webpage. The vulnerability changes the security scope and impacts confidentiality and integrity with no impact on availability. The CVSS 3.1 base score is 5.4, reflecting medium severity with network attack vector, low attack complexity, low privileges required, and user interaction needed.

Successful exploitation could lead to partial compromise of confidentiality and integrity within the victim's browser session, allowing execution of arbitrary JavaScript code. There is no direct impact on system availability. The attack requires user interaction and is limited to the browser context of the victim.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe may manage remediation server-side; verify with Adobe's official advisory. Until a fix is confirmed, users should be cautious about visiting untrusted or suspicious webpages to avoid triggering the vulnerability.