CVE-2026-75729: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75729 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. It allows an attacker with low privileges to inject malicious JavaScript into form fields that are stored and later rendered in a victim's browser, leading to script execution. The vulnerability changes scope, indicating potential impact beyond the initial user context. The CVSS 3.1 base score is 5.4, reflecting medium severity with network attack vector, low attack complexity, low privileges required, and user interaction needed. Confidentiality and integrity impacts are low, with no availability impact.

An attacker with low privileges can inject malicious scripts that execute in the browsers of users who visit affected pages, potentially leading to theft of sensitive information or session hijacking. The scope change indicates the vulnerability may affect resources beyond the attacker’s initial privileges. However, the impact is rated medium due to limited confidentiality and integrity impact and the requirement for user interaction.

No explicit patch or remediation information is provided in the vendor advisory or input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted input and consider applying any recommended workarounds from Adobe.