CVE-2026-75719: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75719 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the Document Object Model (DOM) environment, causing malicious JavaScript to execute in the context of the victim's browser. This attack requires the victim to interact by visiting a maliciously crafted webpage. The vulnerability changes the security scope and affects versions up to 2026.7.0, SP2, and 6.5.24. The CVSS score of 5.4 reflects a medium impact on confidentiality and integrity with no impact on availability.

Successful exploitation could lead to partial confidentiality and integrity compromise by executing arbitrary JavaScript in the victim's browser. This could allow theft of sensitive information or manipulation of the user interface within the affected application context. Availability is not impacted. Exploitation requires user interaction, limiting the attack vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe may manage remediation server-side; verify with Adobe's official advisory. Until a fix is confirmed, avoid visiting untrusted or suspicious links that could trigger the vulnerability.