CVE-2026-75707 is a DOM-based Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this vulnerability by manipulating the Document Object Model (DOM) environment to execute arbitrary JavaScript code within the context of a victim's browser session. This requires the victim to interact by visiting a maliciously crafted webpage. The vulnerability affects the confidentiality and integrity of information accessible in the browser context but does not impact availability. The scope of the vulnerability is changed, indicating that the vulnerability affects components beyond the initially vulnerable component.

Successful exploitation can lead to the execution of arbitrary JavaScript code in the victim's browser, potentially allowing theft of sensitive information or session tokens accessible to the browser. The vulnerability impacts confidentiality and integrity but not availability. Exploitation requires user interaction, limiting the attack vector to social engineering or phishing techniques.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe typically manages remediation server-side. Users and administrators should monitor Adobe's official advisories for updates and apply any provided mitigations or updates promptly once available.