CVE-2026-75705: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75705 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. The flaw enables attackers to execute arbitrary JavaScript by manipulating the Document Object Model (DOM) in the victim's browser. Exploitation necessitates that the victim interacts with a maliciously crafted webpage. The vulnerability impacts confidentiality and integrity but not availability, and the scope of the vulnerability is changed. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and changed scope.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to information disclosure and integrity violations within the affected application session. Availability is not impacted. The vulnerability requires user interaction and does not appear to be exploited in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe whether the service is managed and patched server-side. Until an official fix is available, users should exercise caution when interacting with untrusted content and avoid visiting suspicious links.