CVE-2026-75733 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager as a Cloud Service. It enables a low-privileged attacker to inject malicious JavaScript into vulnerable form fields, which executes in the browser of users who visit the affected pages. The vulnerability has a CVSS 3.1 base score of 5.4, reflecting network attack vector, low attack complexity, required privileges, and user interaction, with a scope change and limited confidentiality and integrity impact. No vendor advisory or patch information is provided, and the vulnerability is not known to be exploited in the wild.

An attacker with low privileges can inject malicious scripts that execute in the browsers of users viewing the affected content, potentially leading to limited confidentiality and integrity impacts. The vulnerability does not affect availability. The scope change indicates the vulnerability affects resources beyond the initial security boundary.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe whether the service is patched or mitigated server-side. Until an official fix is available, consider restricting access to vulnerable form fields or applying input validation and output encoding as temporary mitigations if feasible.