CVE-2026-75731: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75731 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager as a Cloud Service. It allows an attacker with low privileges to inject malicious JavaScript into form fields, which executes in the context of users viewing the affected pages. This can lead to partial confidentiality and integrity impacts but does not affect availability. The vulnerability affects versions up to and including 2026.7.0, SP2, and 6.5.24. No known exploits are reported in the wild. The CVSS 3.1 base score is 5.4, indicating medium severity.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, potentially leading to theft of sensitive information or manipulation of web content. The impact is limited to confidentiality and integrity with no availability impact. The scope is changed, meaning the vulnerability affects resources beyond the attacker’s privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if server-side patches have been applied. Until a fix is confirmed, restrict access to vulnerable form fields and apply input validation or sanitization where possible.