What is the CVSS score of CVE-2025-64830?

CVE-2025-64830 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Adobe Experience Manager CVE-2025-64830

EUVD-2025-210865 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-09-08 psirt@adobe.com

GHSA-fg3m-wg33-jx64

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS requires authenticated low-privilege write access and victim interaction; scope change applies as script executes outside AEM's own context; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 09, 2026 - 01:25 vuln.today

CVE Published

Sep 08, 2026 - 20:17 nvd

MEDIUM 5.4

DescriptionCVE.org

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to persist malicious JavaScript payloads in vulnerable form fields, which then execute in any victim's browser upon page visit. Affected versions span AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). Adobe has addressed the issue in security bulletin APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Adobe Experience Manager is a Java-based enterprise content management platform handling web content authoring, digital asset management, and form-driven workflows. The flaw is a classic stored (persistent) XSS defect (CWE-79) in which attacker-controlled input saved to a form field is later served to other users without sufficient output encoding or sanitization. The CVSS vector records S:C (scope change), indicating the injected script escapes AEM's own execution context and affects the victim's browser environment - consistent with stored XSS where a contributor-level user plants a payload that later runs under a more privileged session, such as an administrator reviewing authored content.

RemediationAI

Apply the patches documented in Adobe Security Bulletin APSB26-98 (https://helpx.adobe.com/security/products/experience-manager/apsb26-98.html). For AEM 6.5, upgrade to a version beyond 6.5.24; for AEM 6.5 LTS, apply a Service Pack beyond SP2; AEM as a Cloud Service environments are remediated on builds beyond 2026.7.0. As interim compensating controls pending patching, restrict form-field authoring permissions to the minimum set of trusted users to reduce the attacker pool, and enforce a strict Content Security Policy (CSP) header to constrain where scripts can execute - noting that CSP requires careful tuning to avoid breaking AEM's own JavaScript-heavy UI. Disabling external or self-service user registration on authoring environments further limits the PR:L attack surface.