CVE-2026-75716: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75716 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. The flaw allows attackers to execute arbitrary JavaScript by manipulating the DOM environment, requiring the victim to visit a maliciously crafted webpage. The vulnerability changes scope and affects several versions of the product. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to information disclosure or manipulation of the user interface. The impact is limited to confidentiality and integrity with no availability impact. Exploitation requires user interaction and visiting a crafted webpage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe whether the service is managed and patched server-side. Until a patch or official fix is available, limit exposure by educating users about phishing and malicious links, and consider applying any recommended temporary mitigations from Adobe.