CVE-2026-75730 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager as a Cloud Service. It enables an attacker with low privileges to inject malicious JavaScript into form fields that persist and execute in the context of other users' browsers when they access the affected pages. The vulnerability impacts confidentiality and integrity but does not affect availability. The scope of the vulnerability is changed, indicating that the impact crosses security boundaries. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, and partial confidentiality and integrity impact. No remediation level or patch information is currently available, and no known exploits have been reported.

An attacker with low privileges can inject malicious scripts that execute in the browsers of users viewing the affected pages, potentially leading to partial compromise of confidentiality and integrity of user data within the application context. There is no impact on availability. The vulnerability affects the security boundary (scope changed), meaning the attack can affect components beyond the initial vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe typically manages remediation server-side. Monitor Adobe's official advisories for updates and apply any provided fixes promptly once available. Until then, consider restricting access to vulnerable form fields or applying input validation and output encoding as temporary mitigations if feasible.