CVE-2026-75718 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. This vulnerability allows an attacker to manipulate the Document Object Model (DOM) environment to execute arbitrary JavaScript code within the context of a victim's browser. Successful exploitation requires the victim to interact by visiting a maliciously crafted webpage. The vulnerability affects confidentiality and integrity but does not affect availability. The CVSS v3.1 base score is 5.4 (medium severity), with attack vector network, low attack complexity, privileges required low, user interaction required, and scope changed. No patch or remediation level has been published, and there are no known exploits in the wild.

An attacker can execute arbitrary JavaScript in the context of the victim's browser, potentially leading to partial confidentiality and integrity compromise of user data within the affected application. There is no impact on system availability. Exploitation requires user interaction and low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Adobe's advisories for updates. Until a fix is available, users should exercise caution when interacting with untrusted content and consider applying any recommended security controls from Adobe once published.