CVE-2026-75731 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager as a Cloud Service. It permits a low-privileged attacker to inject malicious JavaScript into form fields that are stored and later rendered in a victim's browser, potentially leading to script execution in the context of the affected application. The vulnerability affects the confidentiality and integrity of data but does not impact availability. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, required privileges, and user interaction.

Successful exploitation could lead to execution of arbitrary JavaScript in the context of the affected application, potentially allowing theft of sensitive information or session tokens. The impact is limited to confidentiality and integrity, with no direct availability impact. The vulnerability requires user interaction and low privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, the vendor typically manages remediation server-side; verify Adobe's official advisory for updates or mitigation steps. Until a fix is available, restrict access to vulnerable form fields and apply input validation or sanitization if possible.