What is the CVSS score of CVE-2025-64854?

CVE-2025-64854 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Adobe Experience Manager CVE-2025-64854

EUVD-2025-210864 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-09-08 psirt@adobe.com

GHSA-x967-gr5p-hwrh

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Low-privileged account needed to inject content (PR:L); victim must browse to the affected page (UI:R); scope change reflects cross-context browser script execution; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 09, 2026 - 01:24 vuln.today

CVE Published

Sep 08, 2026 - 20:17 nvd

MEDIUM 5.4

DescriptionCVE.org

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields within the CMS. When any user-including administrators-browses to a page containing the injected content, the script executes in their browser under a changed security context (S:C), enabling session hijacking, credential theft, or unauthorized actions performed on behalf of the victim. Affected versions span AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2; no public exploit or active exploitation confirmed via CISA KEV at time of analysis.

Technical ContextAI

Adobe Experience Manager (AEM) is Adobe's enterprise-grade content management system used for building and managing large-scale web experiences. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored (persistent) variant, meaning the malicious payload survives in the CMS data store and is served to every subsequent page visitor. The CVSS scope-change indicator (S:C) is significant: it reflects that injected scripts execute in the victim browser's security context, which may differ from the origin where the injection occurred, enabling cross-origin impacts such as session-cookie exfiltration or manipulation of resources loaded from other origins. Affected products per EUVD are AEM as a Cloud Service ≤2026.7.0, AEM 6.5 ≤6.5.24, and AEM 6.5 LTS ≤SP2. No CPE strings were included in the source data.

RemediationAI

Apply the updates documented in Adobe security bulletin APSB26-98 (https://helpx.adobe.com/security/products/experience-manager/apsb26-98.html). For AEM 6.5, upgrade to a version beyond 6.5.24; for AEM 6.5 LTS, apply the fix beyond SP2; for AEM as a Cloud Service, verify the environment has been updated past release 2026.7.0. Exact patched version numbers are not explicitly stated in the available intelligence and should be confirmed directly from the APSB26-98 bulletin. As a compensating control where immediate patching is not feasible, restrict the ability of low-privileged or untrusted accounts to submit or modify form-field content that is subsequently rendered to other users, and enforce a strict Content Security Policy (CSP) header on AEM-served pages to limit the damage radius of any script execution; note that CSP alone does not prevent injection and should not substitute for patching.