CVE-2026-75706 is a DOM-based Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager as a Cloud Service. This vulnerability allows an attacker to manipulate the DOM environment to execute arbitrary JavaScript code within the context of a victim's browser. Successful exploitation requires the victim to interact with a maliciously crafted webpage. The vulnerability affects the confidentiality and integrity of data but does not impact availability. The scope of the vulnerability is changed, indicating that the vulnerability affects components beyond the initially vulnerable component.

An attacker who successfully exploits this vulnerability can execute arbitrary JavaScript in the context of the victim's browser, potentially leading to information disclosure and integrity issues. However, the attack requires user interaction (visiting a crafted webpage). There is no indication of availability impact. The CVSS score of 5.4 reflects a medium severity level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if the vulnerability has been mitigated server-side. Until an official fix or mitigation is confirmed, users should be cautious about interacting with untrusted links or webpages related to Adobe Experience Manager as a Cloud Service.