What is the CVSS score of CVE-2025-64588?

CVE-2025-64588 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Adobe Experience Manager CVE-2025-64588

EUVD-2025-210867 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-09-08 psirt@adobe.com

GHSA-f97f-g646-cv8f

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Low-priv network auth required to store payload; victim browsing triggers execution in a changed scope (browser); limited C/I, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 09, 2026 - 01:27 vuln.today

CVE Published

Sep 08, 2026 - 20:17 nvd

MEDIUM 5.4

DescriptionCVE.org

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser when they navigate to the affected page. Affected deployments span AEM 6.5 through 6.5.24 and 6.5 LTS through SP2 (on-premises), as well as AEM as a Cloud Service through the July 2026 release (2026.7.0). Adobe has published advisory APSB26-98 confirming the scope-changed impact; no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Adobe Experience Manager (AEM) is an enterprise-grade content management and digital experience platform used for web publishing, digital asset management, and forms workflows. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant: user-supplied input submitted to form fields is persisted without adequate sanitization, and later rendered into HTML output without proper output encoding. When the contaminated page is served, the injected script executes within the victim's browser security context rather than the AEM server's context - producing the scope change (S:C) captured in the CVSS vector. The vulnerability spans two delivery models: the traditional on-premises branch (AEM 6.5 ≤ 6.5.24 and AEM 6.5 LTS ≤ SP2) and the managed SaaS branch (AEM as a Cloud Service ≤ 2026.7.0), indicating the flaw is present in shared rendering or form-handling code across both branches.

RemediationAI

Adobe has addressed this vulnerability through security bulletin APSB26-98 (https://helpx.adobe.com/security/products/experience-manager/apsb26-98.html); consult the advisory for the exact fixed Service Pack or release version beyond AEM 6.5.24 and AEM 6.5 LTS SP2, as the precise target version is not enumerated in the available references. AEM as a Cloud Service customers should confirm their environment has received the 2026.7.0 or later automated service update via the Adobe Admin Console. Where immediate patching is not feasible, restrict the AEM author role to fully trusted internal personnel and revoke it from external contractors or users with elevated attack surface. Enabling a restrictive Content Security Policy on AEM publish and author tiers mitigates injected-script execution by blocking inline scripts. Additionally, auditing existing form-field content for anomalous script tags before patching reduces residual risk from already-stored payloads. These compensating controls carry the trade-off of potential operational friction for legitimate rich-content authoring workflows.