CVE-2026-75735 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager as a Cloud Service. It allows an attacker with low privileges to inject malicious JavaScript into form fields, which is then executed in the browsers of users who visit the affected pages. The vulnerability impacts confidentiality and integrity but does not affect availability. The scope of the vulnerability is changed, indicating a potential impact beyond the original security boundary. No vendor advisory or patch information is currently available.

An attacker could exploit this vulnerability to execute arbitrary JavaScript in the context of users' browsers, potentially leading to information disclosure or manipulation of user interactions. The CVSS score of 5.4 reflects a medium severity impact with low attack complexity and low privileges required. There is no indication of availability impact or known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe typically manages remediation server-side; verify with Adobe's official security advisories for updates. Until a fix is available, consider limiting user input in vulnerable form fields and applying web application firewall (WAF) rules to detect and block malicious scripts if possible.