CVE-2026-75725: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75725 is a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the DOM environment, causing malicious JavaScript to execute within the victim's browser context. The attack requires the victim to interact by visiting a specially crafted webpage. The vulnerability changes the security scope and affects versions up to 2026.7.0, SP2, and 6.5.24.

Successful exploitation could lead to the execution of malicious scripts in the context of the victim's browser, potentially allowing the attacker to steal sensitive information or perform actions on behalf of the user. The CVSS score is 5.4 (medium severity), indicating limited but notable impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if the service is managed and patched server-side. Until an official fix is available, users should exercise caution when interacting with untrusted links or webpages.