CVE-2026-79905: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-79905 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. A low-privileged attacker can exploit this flaw by injecting malicious scripts into vulnerable form fields. These scripts execute in the context of a victim's browser when they access the affected page, potentially leading to information disclosure or session hijacking. The vulnerability affects versions up to and including 2026.7.0, SP2, and 6.5.24. The CVSS v3.1 base score is 5.4, indicating medium severity, with attack vector network, low attack complexity, low privileges required, and user interaction required. The scope is changed, and the impact includes low confidentiality and integrity impacts but no availability impact.

The vulnerability allows execution of malicious JavaScript in the victim's browser, which can lead to partial confidentiality and integrity compromise. However, it does not affect system availability. Exploitation requires user interaction and low privileges, with network attack vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if the service is managed and patched server-side. Until an official fix is available, restrict access to vulnerable form fields and apply input validation or sanitization where possible.