CVE-2026-75704 is a DOM-based Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager as a Cloud Service. This vulnerability allows an attacker to manipulate the DOM environment to execute arbitrary JavaScript code within the context of a victim's browser. Exploitation requires that the victim interacts by visiting a maliciously crafted webpage. The vulnerability changes the security scope and affects confidentiality and integrity of data. The CVSS v3.1 base score is 5.4 (medium severity), with attack vector network, low attack complexity, low privileges required, user interaction required, and scope changed. No vendor advisory or patch information is currently available.

Successful exploitation could lead to unauthorized execution of JavaScript in the victim's browser, potentially exposing sensitive information or altering data integrity within the affected application context. There is no impact on availability. The attack requires user interaction (visiting a crafted webpage). No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted content and avoid visiting suspicious links. Monitor Adobe's official security advisories for updates on remediation.