CVE-2026-75727 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager as a Cloud Service. It enables a low-privileged attacker to inject malicious JavaScript into vulnerable form fields, which executes in the context of a victim's browser when they visit the affected page. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity) with network attack vector, low attack complexity, low privileges required, and requires user interaction. The scope is changed, indicating impact beyond the vulnerable component. No vendor advisory or patch information is currently provided.

An attacker with low privileges can inject malicious scripts that execute in the browsers of users who visit the affected pages, potentially leading to information disclosure or session hijacking. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change suggests the vulnerability may affect components beyond the immediate vulnerable area.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to vulnerable form fields and applying web application firewall rules to detect and block malicious script injections where possible.