CVE-2026-75740: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75740 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager as a Cloud Service. It enables low-privileged attackers to inject malicious JavaScript into form fields that are stored and later rendered to users. This can lead to script execution in the context of the victim's browser session. The vulnerability affects multiple versions up to 2026.7.0, SP2, and 6.5.24. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and impacts on confidentiality and integrity but not availability.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers when they access the affected pages, potentially leading to information disclosure or session hijacking. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires user interaction and low privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe may manage remediation server-side; verify with Adobe's official advisory. Until a fix is confirmed, avoid using vulnerable form fields or apply input validation and output encoding as temporary mitigations if possible.