CVE-2026-75738 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager as a Cloud Service. It enables an attacker with low privileges to inject malicious JavaScript code into form fields that are not properly sanitized. When other users browse pages containing these fields, the injected scripts may execute in their browsers, potentially leading to information disclosure or session hijacking. The vulnerability affects the scope of the service and has a CVSS 3.1 base score of 5.4, indicating medium severity. No vendor advisory or patch information is currently available.

The vulnerability allows execution of malicious scripts in the browsers of users who visit pages containing the injected content. This can lead to limited confidentiality and integrity impacts, such as theft of user data or manipulation of page content. There is no indication of availability impact. The attack requires user interaction (UI:R) and low privileges (PR:L).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if the service is managed and patched server-side. Until a fix is available, consider restricting access to vulnerable form fields or applying input validation and output encoding as temporary mitigations if possible.