CVE-2026-75727: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75727 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. It enables attackers with low privileges to inject malicious JavaScript into form fields that are stored and later executed in the browsers of users accessing those pages. The vulnerability affects versions up to and including 2026.7.0, SP2, and 6.5.24. The CVSS 3.1 base score is 5.4, indicating medium severity, with attack vector network, low attack complexity, low privileges required, user interaction required, and scope changed. No known exploits in the wild or vendor patch information is provided.

Successful exploitation could lead to execution of arbitrary JavaScript in the context of affected users' browsers, potentially leading to information disclosure or session hijacking. The impact is limited by the requirement for user interaction and the low privileges needed to inject the script. There is no indication of availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe may manage remediation server-side; users should monitor official Adobe advisories for updates. Until a fix is confirmed, avoid entering untrusted data into vulnerable form fields and apply any recommended temporary mitigations from Adobe.