CVE-2026-75738: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75738 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager as a Cloud Service. It enables a low-privileged attacker to inject malicious JavaScript into form fields that are not properly sanitized. The injected script executes in the context of a victim's browser when they access the affected page, potentially leading to information disclosure or session hijacking. The vulnerability affects versions up to and including 2026.7.0, SP2, and 6.5.24. The CVSS v3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, changed scope, and low impact on confidentiality and integrity with no availability impact.

An attacker with low privileges can inject malicious scripts that execute in the browsers of users who visit the affected pages. This can lead to limited confidentiality and integrity impacts such as theft of session tokens or unauthorized actions performed in the context of the victim user. There is no reported impact on availability. The scope change indicates the vulnerability affects resources beyond the attacker's privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe may manage remediation server-side. Until an official fix is available, restrict access to vulnerable form fields and apply input validation or sanitization where possible.