CVE-2026-75717: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75717 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the Document Object Model (DOM) to execute arbitrary JavaScript code in the context of the victim's browser. This requires the victim to interact by visiting a maliciously crafted webpage. The vulnerability affects versions up to and including 2026.7.0, SP2, and 6.5.24. The scope of the vulnerability is changed, indicating that the impact may extend beyond the initially vulnerable component. The CVSS v3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, low privileges required, and user interaction necessary. Confidentiality and integrity impacts are low, with no impact on availability.

Successful exploitation could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to information disclosure or manipulation of client-side data. The attack requires user interaction, limiting the ease of exploitation. There is no indication of active exploitation in the wild. The vulnerability affects confidentiality and integrity to a limited extent and does not impact availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe may manage remediation server-side; verify with Adobe's official advisory. Until a fix is available, users should exercise caution when interacting with untrusted links or webpages. No specific temporary mitigations are provided in the available data.