CVE-2026-75733: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75733 describes a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields, which is then executed in the context of users' browsers when they access the affected pages. This vulnerability impacts confidentiality and integrity but does not affect availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and scope change.

Successful exploitation could lead to execution of arbitrary JavaScript in the context of affected users, potentially allowing theft of sensitive information or session tokens. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires user interaction and low privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if the service is patched server-side or if any configuration changes are recommended. Until official guidance is available, restrict access to vulnerable form fields and apply standard XSS mitigations where possible.