What is the CVSS score of CVE-2025-64610?

CVE-2025-64610 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Adobe Experience Manager CVE-2025-64610

EUVD-2025-210872 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-09-08 psirt@adobe.com

GHSA-fj9x-mqg3-w8xm

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L required for authoring access; UI:R for victim page visit; S:C captures cross-user browser execution; C:L/I:L reflect partial session and DOM impact only.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 09, 2026 - 01:27 vuln.today

CVE Published

Sep 08, 2026 - 20:17 nvd

MEDIUM 5.4

DescriptionCVE.org

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browsers of other users - including administrators - when they visit the affected page. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit or CISA KEV listing has been identified at time of analysis; the scope-changed CVSS vector reflects the cross-user browser impact.

Technical ContextAI

Adobe Experience Manager (AEM) is an enterprise-grade content management system used for digital experience delivery across web, mobile, and cloud channels. The vulnerability is a stored XSS (CWE-79), in which user-supplied input written to AEM's content repository is later rendered back to other users without sufficient output encoding or HTML sanitization. The CVSS Scope Changed (S:C) metric is technically accurate here: the injected script executes in the victim's browser security context - a different principal than the AEM application server itself - allowing the attacker to access DOM data, session tokens, and same-origin resources belonging to the victim. Affected CPE data (inferred from EUVD version ranges) covers the AEM 6.5 LTS branch, the AEM 6.5 Classic branch, and the AEM as a Cloud Service SaaS offering, indicating the vulnerability exists across both on-premises and cloud-hosted deployments.

RemediationAI

Per Adobe Security Bulletin APSB26-98 (https://helpx.adobe.com/security/products/experience-manager/apsb26-98.html), organizations should upgrade AEM 6.5 LTS beyond SP2, AEM 6.5 Classic beyond 6.5.24, and AEM as a Cloud Service beyond 2026.7.0 as the primary fix. Exact patched release numbers should be confirmed from the advisory, as the input data does not specify them beyond the boundary versions. As a compensating control where immediate patching is not feasible, restricting the 'author' and 'contributor' roles to only fully vetted internal users reduces the risk surface - note this may impact external contributor workflows. Enabling a strict Content Security Policy (CSP) on AEM publish and author tiers can limit the effectiveness of injected scripts even if the XSS is triggered, though CSP configuration in AEM requires careful testing to avoid breaking legitimate functionality.