CVE-2026-83960: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2026-83960 describes a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this vulnerability by manipulating the Document Object Model (DOM) environment, causing malicious JavaScript to execute within the context of a victim's browser. This attack requires the victim to interact by visiting a specially crafted webpage. The vulnerability impacts confidentiality and integrity with limited privileges required and user interaction necessary. The scope of the vulnerability is changed, indicating that the vulnerability affects resources beyond the initially vulnerable component.

Successful exploitation could lead to the execution of arbitrary JavaScript in the context of the victim's browser, potentially allowing the attacker to steal sensitive information or perform actions on behalf of the user. The impact is limited to confidentiality and integrity with no impact on availability. The attack requires user interaction and low complexity to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe typically manages remediation server-side. Users should monitor Adobe's official advisories for updates and apply any provided patches or mitigations promptly.