CVE-2026-75722: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75722 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the Document Object Model (DOM) environment to execute arbitrary JavaScript code within the victim's browser context. The attack requires the victim to interact by visiting a maliciously crafted webpage. The vulnerability changes the scope of the affected component. The CVSS 3.1 base score is 5.4 (medium), with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and limited confidentiality and integrity impact without availability impact.

Successful exploitation allows an attacker to execute malicious JavaScript in the victim's browser, potentially leading to limited confidentiality and integrity impacts within the context of the affected application. The attack requires user interaction and low privileges, with no direct impact on system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe whether the service is managed and patched server-side. Until an official fix is available, avoid visiting untrusted or suspicious links and consider applying any recommended workarounds from Adobe.