CVE-2026-75742: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-75742 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. It enables an attacker with low privileges to inject malicious JavaScript into vulnerable form fields. This script executes in the context of users who visit the affected page, potentially leading to information disclosure or session hijacking. The vulnerability affects versions up to 2026.7.0, SP2, and 6.5.24. The scope of the vulnerability is changed, and the CVSS v3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). There is no indication of known exploits in the wild or vendor-provided patch information in the input data.

An attacker with low privileges can inject malicious scripts that execute in the browsers of users visiting the affected pages, potentially leading to limited confidentiality and integrity impacts. There is no reported impact on availability. The vulnerability's scope change indicates that the impact may extend beyond the initially affected components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe may manage remediation server-side; verify with Adobe's official advisory. Until a fix is confirmed, restrict access to vulnerable form fields and apply input validation or output encoding where possible to mitigate exploitation.