CVE-2026-75720: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75720 describes a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. The flaw allows attackers to execute arbitrary JavaScript by manipulating the Document Object Model (DOM) in the victim's browser. Successful exploitation depends on user interaction, requiring the victim to visit a maliciously crafted webpage. The vulnerability affects multiple versions of Adobe Experience Manager as a Cloud Service, including versions up to 2026.7.0, SP2, and 6.5.24. The vulnerability has a CVSS 3.1 base score of 5.4, with network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and impacts on confidentiality and integrity but not availability.

An attacker who successfully exploits this DOM-based XSS vulnerability can execute arbitrary JavaScript code within the context of the victim's browser, potentially leading to unauthorized actions or data disclosure limited to the scope of the affected application. The attack requires user interaction (visiting a crafted webpage). The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe may manage remediation server-side; verify with Adobe's official advisory. Until a fix is confirmed, users should exercise caution with untrusted links and avoid visiting suspicious webpages. No official fix or patch links are currently provided.