CVE-2026-75734: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75734 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. It enables an attacker with low privileges to inject malicious JavaScript into form fields that are stored and later rendered to users, causing script execution in their browsers. The vulnerability affects versions up to and including 2026.7.0, SP2, and 6.5.24. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and impacts on confidentiality and integrity but not availability.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of the victim's browser session when viewing the affected pages. This may lead to information disclosure or manipulation of data accessible to the user. The vulnerability does not impact system availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe whether the service is managed and patched server-side. Until a fix is confirmed, restrict access to vulnerable form fields and monitor for suspicious activity related to script injection.