What is the CVSS score of CVE-2025-64866?

CVE-2025-64866 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Adobe Experience Manager CVE-2025-64866

EUVD-2025-210863 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-09-08 psirt@adobe.com

GHSA-q278-gfvf-f3vp

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-reachable stored XSS requiring low-privilege account (PR:L) and victim page visit (UI:R); scope changes to victim browser context; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 09, 2026 - 01:24 vuln.today

CVE Published

Sep 08, 2026 - 20:17 nvd

MEDIUM 5.4

DescriptionCVE.org

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in any victim's browser that subsequently visits the affected page. The scope-changed nature of this flaw (S:C in CVSS) means the attacker's script runs within the victim's browser security context, enabling session token theft, credential harvesting, or further client-side attacks. Affected deployments span AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2; no public exploit code or KEV listing has been identified at time of analysis.

Technical ContextAI

Adobe Experience Manager is a widely deployed enterprise content management system used for digital marketing and web publishing. The vulnerability class is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant, where attacker-supplied input is persisted server-side and later rendered unsanitized in HTML output. The affected versions span both the on-premise AEM 6.5 line (≤6.5.24 and LTS ≤SP2) and the SaaS-hosted AEM as a Cloud Service (≤2026.7.0). The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L reflects a network-reachable attack with low complexity once an account is obtained, requiring a victim to view the injected page. The scope change (S:C) is characteristic of stored XSS where the injected script crosses from the server security context into the victim browser's context.

RemediationAI

Consult Adobe security advisory APSB26-98 (https://helpx.adobe.com/security/products/experience-manager/apsb26-98.html) for patch details; the advisory is confirmed referenced by NVD. Patch availability per vendor advisory is stated, but the exact fixed release versions are not independently confirmed from the provided input data - operators should verify available updates against the APSB26-98 advisory for their specific deployment type (Cloud Service vs. AEM 6.5 vs. 6.5 LTS). As a compensating control, restrict content-creation and form-editing roles to trusted internal users only, and enforce Content Security Policy (CSP) headers on AEM-served pages to limit the execution context of any injected scripts - note that CSP misconfiguration can break legitimate AEM functionality, so testing is required. Additionally, ensure session cookies are set with the HttpOnly flag to reduce the value of any successfully injected script that targets cookie theft.