CVE-2026-75741: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75741 is a stored Cross-Site Scripting (CWE-79) vulnerability in Adobe Experience Manager as a Cloud Service. It allows an attacker with low privileges to inject malicious JavaScript into form fields that are stored and later rendered in the victim's browser, potentially leading to script execution. The vulnerability affects versions up to and including 2026.7.0, SP2, and 6.5.24. The CVSS v3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, scope change, and impacts on confidentiality and integrity but not availability.

An attacker with low privileges can inject malicious scripts into form fields that are stored and executed in the context of other users' browsers. This can lead to unauthorized disclosure of information and modification of data within the affected application context. There is no indication of availability impact or known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe may manage remediation server-side; verify with Adobe's official advisory. Until a fix is confirmed, exercise caution with user input and consider temporary mitigations such as input validation or output encoding if feasible.