CVE-2026-75714 describes a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. The vulnerability enables an attacker to execute arbitrary JavaScript by manipulating the Document Object Model (DOM) in the victim's browser after the victim visits a maliciously crafted webpage. The scope of the vulnerability is changed, indicating a potential impact beyond the initially vulnerable component. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges as low, user interaction required, changed scope, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation could lead to execution of malicious scripts in the context of the victim's browser, potentially allowing information disclosure or manipulation of client-side data. The impact is rated medium with limited confidentiality and integrity impact and no availability impact. Exploitation requires user interaction, reducing the likelihood of automated attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if the service is managed and patched server-side. Until official fixes are available, avoid visiting untrusted links and consider applying any recommended workarounds from Adobe advisories.