Adobe Experience Manager
CVE-2025-64791
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged AEM author account
-
DeliveryInject script into vulnerable form field
-
ExploitPayload stored in repository
-
ExecutionVictim browses affected page
-
ImpactScript executes in victim browser session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated low-privileged AEM account with permission to submit content into the vulnerable form fields (PR:L), plus a victim who subsequently browses to the page rendering that stored field (UI:R). Impact is limited to script execution in the victim's browser (C:L/I:L, no availability impact). Limiting factors: attacker must already have valid authoring credentials, the payload is stored/persistent but inert until a victim navigates to the specific page, and only products at or below AEM 6.5.23 (including Cloud Service and 6.5 LTS) are affected. This is not remotely exploitable against an unauthenticated default configuration. |
| Impact | This is a classic high-noise/low-priority stored XSS. The CVSS 3.1 base score of 5.4 (MEDIUM) is honest and I agree with it: AV:N is offset by three real gates - PR:L (attacker needs an authenticated low-privilege account with content/form-authoring access), UI:R (a victim must browse to the affected page), and impact limited to C:L/I:L/A:N. Exploitation-probability signals reinforce low real-world urgency: EPSS is 0.25% (15th percentile), there is no CISA KEV listing (not actively exploited), and no public POC has been identified. No SSVC decision point is supplied, but inferring from the data: exploitation=none, automatable=no (requires an authenticated actor to plant the payload and a victim to navigate), technical impact=partial. All signals are consistent - there is no CVSS-vs-EPSS or vector-vs-description conflict here. Net: a legitimate defense-in-depth patch for enterprises running AEM, but not an emergency; it ranks well below the unauthenticated/session-takeover AEM DOM-XSS issues (e.g. the 9.3 CVE-2025-64537/64539) disclosed in the same APSB25-115 batch. |
| Exploit ScenarioDerived | A low-privileged AEM author-tier user submits a form-field value containing malicious JavaScript that is stored without proper output encoding. When a higher-privileged user or another visitor later browses the page rendering that field, the script executes in their browser session, enabling actions such as CSRF-style requests or limited data theft in the victim's authenticated context. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (including AEM Cloud Service and the 6.5 LTS track) lets a low-privileged authoring user persist malicious JavaScript into form fields, which then executes in the browser of any user who later views the affected page. Exploitation is not remote and unauthenticated: per the CVSS vector PR:L the attacker must already hold an authenticated AEM account able to submit content into the vulnerable fields, and per UI:R a separate victim must browse to the page rendering that stored content, with impact confined to limited confidentiality and integrity loss in the victim's session (scope change S:C, no availability impact). Risk is low in practice - EPSS is 0.25% (15th percentile), the issue is not in CISA KEV, and no public exploit code was identified at time of analysis - although Adobe tracked it under its APSB25-115 security bulletin, so patched builds are available from the vendor.
RemediationAI
Apply the update published in Adobe's APSB25-115 security bulletin (https://helpx.adobe.com/security/products/experience-manager/apsb25-115.html), which is the authoritative source for the fixed build numbers for the 6.5 LTS, on-premise, and Cloud Service tracks - patch status is 'patch available per vendor advisory', so any deployment running 6.5.23 or earlier should be upgraded to the release levels listed there; AEM Cloud Service customers are generally updated automatically, but should confirm exposure with Adobe. Because this is a stored XSS, patching alone is insufficient: audit and sanitize previously submitted form field content for injected script, review AEM authored content and any custom form components for missing output encoding, and enforce strict CSP on rendered pages as a compensating control - noting that a restrictive CSP can break legitimate inline scripts and AEM clientlib behavior and must be tested in staging first. Until an upgrade can be scheduled, reduce the attack surface by restricting form-submission and authoring permissions to the minimum set of trusted accounts, disabling or locking down any publicly reachable AEM form endpoints that accept anonymous submissions, and monitoring for anomalous JavaScript in form field values; these controls lower the likelihood of a low-privileged account persisting a payload but do not eliminate the underlying rendering flaw, and no public exploit code was identified at time of analysis, so prioritization can be weighted accordingly against higher-EPSS issues.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. cross-site scripting) in its stored/persistent variant: content supplied through AEM form fields is written into the repository (JCR) and later re-rendered without adequate output encoding or sanitization, so the injected script is served to every subsequent visitor of that page rather than only echoed back to the submitter. The CVSS:3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N describes an over-HTTP attack that is trivially repeatable (AC:L) but gated behind a valid low-privileged credential (PR:L) and victim interaction (UI:R), with the scope change (S:C) reflecting that the executed script runs in the victim's browser security context, outside the vulnerable component itself; confidentiality and integrity are limited (C:L/I:L) because typical impact is session/token theft or UI manipulation rather than server compromise, and availability is unaffected (A:N). The CPE data confirms the affected surface spans several AEM deployment shapes: generic Adobe Experience Manager builds (cpe:2.3:a:adobe:experience_manager:*:*:*:*:-), the AEM Cloud Service edition (aem_cloud_service), and the 6.5 LTS channel (adobe:experience_manager:6.5:...:lts), with everything at or below 6.5.23 in range. Because the payload is stored server-side, cleanup requires both patching and remediation of already-persisted malicious content, not just a code fix.
Know when Experience Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-reachable web app but requires an authenticated low-priv author (PR:L) and victim page visit (UI:R); stored XSS crosses into the browser (S:C) with limited C/I and no availability impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)CVE.org
More in Experience Manager
View allSitecore Experience Manager, Platform, and Commerce versions 9.0 through 10.4 contain a Zip Slip vulnerability that allo
Sitecore PowerShell Extensions through version 7.0 allows authenticated users to upload arbitrary files including ASPX w
Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, wh
Adobe Experience Manager versions 6.5.23.0 and earlier contain a deserialization of untrusted data vulnerability that al
Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 through 10.4.1 contain a hardcoded administr
The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows r
Multiple Sitecore products allow remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remote
Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability. Rated critical severity (CVSS 9.8
Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerabilit
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), S
An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0
An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Comme
GitHub PoC
Exploit-DB