CVE-2026-75724: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75724 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the Document Object Model (DOM) to execute arbitrary JavaScript code within the victim's browser. Successful exploitation requires the victim to interact with a maliciously crafted webpage. The vulnerability affects versions up to 2026.7.0, SP2, and 6.5.24. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction needed, changed scope, and impacts confidentiality and integrity with no impact on availability.

Exploitation of this vulnerability could lead to unauthorized execution of JavaScript in the context of the victim's browser, potentially allowing theft of sensitive information or session hijacking. The impact is limited to confidentiality and integrity with no availability impact. User interaction is required for exploitation, which reduces the risk somewhat. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe may manage remediation server-side; verify with Adobe's official advisory. Until a patch is available, users should be cautious about visiting untrusted or suspicious webpages. No specific vendor advisory or patch links are provided at this time.