CVE-2026-75737: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75737 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. It allows an attacker with low privileges to inject malicious JavaScript into form fields that are stored and later rendered in a victim's browser, leading to script execution. The vulnerability affects multiple versions of the product, including versions up to 2026.7.0, SP2, and 6.5.24. The vulnerability has a CVSS 3.1 score of 5.4, with attack vector network, low attack complexity, low privileges required, user interaction required, and scope changed. No known exploits in the wild have been reported. Patch or remediation information is not provided in the input data.

Successful exploitation could lead to execution of arbitrary JavaScript in the context of the victim's browser session, potentially allowing theft of sensitive information or session hijacking. The impact is limited to confidentiality and integrity, with no availability impact. The attacker requires low privileges and user interaction to exploit the vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe whether the service is patched server-side. Until a fix is confirmed, avoid using vulnerable form fields or restrict access to trusted users. Monitor vendor advisories for updates.