CVE-2026-75729 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager as a Cloud Service. It enables a low-privileged attacker to inject malicious JavaScript into form fields, which is then executed in the context of other users' browsers when they access the vulnerable page. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity, with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts confidentiality and integrity with scope change. No patch or official remediation level has been provided in the available data.

An attacker with low privileges can inject malicious scripts that execute in other users' browsers, potentially leading to unauthorized disclosure or modification of information within the affected application context. The vulnerability does not impact system availability. The scope change indicates that the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe whether the vulnerability has been mitigated server-side. Until an official fix is available, limit exposure by restricting access to vulnerable form fields and applying web application firewall rules if possible.