What is the CVSS score of CVE-2025-64618?

CVE-2025-64618 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Adobe Experience Manager CVE-2025-64618

EUVD-2025-210870 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-09-08 psirt@adobe.com

GHSA-v78v-w8gv-wmcj

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Low-privileged account needed to inject, victim interaction required to trigger; scope change captures browser-context execution; no availability impact from script execution alone.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 09, 2026 - 01:26 vuln.today

CVE Published

Sep 08, 2026 - 20:17 nvd

MEDIUM 5.4

DescriptionCVE.org

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored XSS in Adobe Experience Manager permits low-privileged authenticated users to inject persistent JavaScript payloads into vulnerable form fields within the CMS authoring interface. When any user - including administrators - browses a page containing the injected field, their browser executes the attacker's script in the context of the AEM domain, with scope change confirming cross-boundary impact. All AEM 6.5 versions through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 build are affected; remediation is available via Adobe APSB26-98. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Adobe Experience Manager is a Java-based enterprise content management and digital experience platform widely used for web publishing, forms, and digital asset management. The vulnerability is a persistent (stored) cross-site scripting flaw (CWE-79), meaning malicious JavaScript is written to the server-side data store via a form field and then re-served to all subsequent page visitors without adequate sanitization or output encoding. The CVSS S:C (scope changed) metric reflects that the injected script executes in the victim's browser security context rather than strictly within the server application, crossing the trust boundary of the web origin. Affected products span the on-premises 6.5 branch (including the Long-Term Support variant) and the cloud-managed AEM as a Cloud Service offering, indicating the flaw exists in shared CMS authoring components.

RemediationAI

Apply the patches specified in Adobe Security Bulletin APSB26-98 at https://helpx.adobe.com/security/products/experience-manager/apsb26-98.html. For AEM 6.5 on-premises, upgrade to the version superseding 6.5.24 per the bulletin. For AEM 6.5 LTS, apply the service pack beyond SP2 as directed by the advisory. AEM as a Cloud Service customers should confirm their managed environment has been updated past build 2026.7.0, which Adobe typically handles automatically for cloud tenants. As a compensating control prior to patching, restrict AEM authoring and form-editing permissions to the minimum necessary set of trusted users, reducing the pool of accounts that could inject payloads. Content Security Policy (CSP) headers configured to block inline script execution can also limit the impact of any stored XSS payload that reaches end users.