What is the CVSS score of CVE-2025-64584?

CVE-2025-64584 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Adobe Experience Manager CVE-2025-64584

EUVD-2025-210871 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-09-08 psirt@adobe.com

GHSA-8ff2-5c2f-xj93

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS requires a low-privileged author account (PR:L) and victim page visit (UI:R); script executes cross-context (S:C) with limited C/I impact on victim session.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 09, 2026 - 01:27 vuln.today

CVE Published

Sep 08, 2026 - 20:17 nvd

MEDIUM 5.4

DescriptionCVE.org

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields that persists and executes in the browsers of other users who visit the affected page. Affected products span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The scope-changed nature of the vulnerability means the attacker's payload crosses from the AEM application context into victim browser sessions, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Adobe Experience Manager is an enterprise-grade content management system (CMS) used for web, mobile, and digital asset management. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes stored XSS, where user-supplied input is persisted in the application's data store without adequate sanitization or output encoding and later rendered in HTML responses viewed by other users. The CVSS vector S:C (scope changed) reflects that the injected script executes in the victim's browser security context - a different principal from the AEM application server itself - potentially accessing cookies, localStorage, and performing same-origin requests on behalf of the victim. The affected surface is form fields within the AEM authoring or publishing environment. Affected CPE covers AEM 6.5 ≤ 6.5.24, AEM 6.5 LTS ≤ SP2, and AEM as a Cloud Service ≤ 2026.7.0.

RemediationAI

Apply the patches documented in Adobe security advisory APSB26-98 (https://helpx.adobe.com/security/products/experience-manager/apsb26-98.html). For AEM 6.5, upgrade beyond version 6.5.24; for AEM 6.5 LTS, apply a service pack beyond SP2; for AEM as a Cloud Service, ensure the instance has been updated past the 2026.7.0 release cadence. Exact fix version numbers should be confirmed against the APSB26-98 advisory, as the input data specifies only the upper boundary of affected versions. As a compensating control prior to patching, enforce strict input sanitization and output encoding policies in AEM's content policy framework, limit form-field authoring permissions to the smallest possible set of trusted contributor accounts, and consider enabling AEM's built-in XSS protection rules in the OWASP Anti-Samy configuration.