What is the CVSS score of CVE-2025-64868?

CVE-2025-64868 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Adobe Experience Manager CVE-2025-64868

EUVD-2025-210869 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-09-08 psirt@adobe.com

GHSA-48rv-xvgf-vhfx

XSS Adobe Experience Manager

5.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L required (AEM account needed); S:C reflects XSS executing in victim's browser scope; A:N as stored XSS has no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 09, 2026 - 01:23 vuln.today

CVE Published

Sep 08, 2026 - 20:17 nvd

MEDIUM 5.4

DescriptionCVE.org

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

AnalysisAI

Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any user - including higher-privileged administrators - browses to the page containing the injected payload, the script executes in their browser context, crossing scope boundaries into the victim's session. Affected versions span AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2, as confirmed by APSB26-98. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Adobe Experience Manager (AEM) is an enterprise-grade content management system used for building and managing web properties. CWE-79 (Improper Neutralization of Input During Web Page Generation) applies here: user-supplied content submitted to form fields is stored in AEM's content repository (JCR/Oak) without adequate sanitization or output encoding, and is subsequently rendered back to other users' browsers unescaped. The CVSS scope-changed (S:C) flag reflects the canonical stored-XSS model: the vulnerability exists in AEM's form rendering layer, but the impact escapes into the victim's browser execution environment, a separate security principal. Affected CPE coverage spans AEM 6.5 on-premise (≤6.5.24), AEM 6.5 LTS (≤SP2), and AEM as a Cloud Service (≤2026.7.0).

RemediationAI

Apply the patches documented in Adobe security bulletin APSB26-98 at https://helpx.adobe.com/security/products/experience-manager/apsb26-98.html. Based on the affected version ranges provided (≤6.5.24 for AEM 6.5, ≤2026.7.0 for Cloud Service, ≤SP2 for AEM 6.5 LTS), the expected fix targets are AEM 6.5.25+, AEM as a Cloud Service 2026.8.0+, and AEM 6.5 LTS SP3+, but these specific versions are inferred from the boundary data and not independently confirmed from the provided input - consult the APSB26-98 advisory directly for authoritative fix version numbers. As a compensating control prior to patching, restrict AEM author-tier access to trusted users only and review content contributor permissions to remove unnecessary accounts. AEM's built-in XSS protection filters (AntiSamy/OWASP ESAPI integration) should be verified as enabled and up to date in the AEM Security Checklist configuration.