CVE-2026-75704: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75704 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this vulnerability by manipulating the Document Object Model (DOM) environment, causing malicious JavaScript to execute within the victim's browser. Successful exploitation requires the victim to interact by visiting a specially crafted webpage. The vulnerability affects versions up to and including 2026.7.0, SP2, and 6.5.24. The scope of the vulnerability is changed, and the CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, low privileges required, and user interaction necessary.

The vulnerability allows an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to information disclosure and integrity impacts. Availability is not affected. The attack requires user interaction and low privileges, with the scope changed, meaning the impact crosses security boundaries within the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe may manage remediation server-side; verify with Adobe's official advisory. Until a fix is confirmed, users should exercise caution with untrusted links and crafted webpages.