CVE-2026-83958: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-83958 describes a DOM-based Cross-Site Scripting vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the Document Object Model (DOM) environment, causing malicious JavaScript to execute within the victim's browser. This requires the victim to interact by visiting a specially crafted webpage. The vulnerability affects confidentiality and integrity with a CVSS 3.1 base score of 5.4 (medium severity). The scope of the vulnerability is changed, indicating that the impact crosses security boundaries. No known exploits are reported in the wild. The affected versions include those up to 2026.9.28187 and version 6.5.25 as explicitly stated.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to partial confidentiality and integrity loss of the victim's data within the affected application. There is no impact on availability. The attack requires user interaction (visiting a malicious webpage). No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if the service is managed and patched server-side. Until an official fix is available, users should be cautious about visiting untrusted or suspicious webpages that could exploit this vulnerability.