Adobe Experience Manager
CVE-2025-64888
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege AEM account
-
DeliveryCraft malicious URL or manipulated page with DOM-XSS payload
-
ExploitLure victim to interact
-
ExecutionScript executes in victim's browser session
-
ImpactSteal session data or perform actions as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an attacker to hold a low-privileged authenticated account within Adobe Experience Manager (6.5.23 or earlier, including AEM Cloud Service and AEM 6.5 LTS) and requires victim user interaction - the victim must visit a crafted URL or interact with a manipulated web page for the DOM-based script to execute. Exploitation is limited by these two independent gates (existing authenticated access plus social-engineering-driven interaction), and impact is confined to the victim's browser context (C:L/I:L, no availability impact), meaning no server-side code execution. |
| Impact | This is a high-CVSS-context product with a genuinely low-severity, low-real-risk flaw. The CVSS 3.1 base score of 5.4 (Medium) is itself modest, and every signal reinforces low priority: EPSS is only 0.20% (9th percentile), there is no CISA KEV listing, and no public POC has been identified. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) shows two independent gating factors - the attacker must already hold low-privilege authenticated access (PR:L) AND the victim must perform an interaction (UI:R) - while impact is limited to C:L/I:L with no availability effect. The scope change (S:C) reflects standard DOM-XSS crossing from the vulnerable AEM component into the victim's browser session, which is why the score reaches 5.4 rather than lower. No signals conflict: low EPSS, no KEV, no POC, and a double-gated Medium vector all point the same direction. The main counterweight is product ubiquity in enterprise digital-experience stacks, but that raises exposure breadth, not per-instance exploitability. Net: real but low-priority; patch on normal cadence. |
| Exploit ScenarioDerived | A low-privileged AEM author or user with content-authoring access crafts a malicious URL or manipulated page that injects script into a DOM sink; a higher-privileged victim (e.g., an administrator or reviewer) then clicks the crafted link or interacts with the page and the script runs in their authenticated AEM browser session. No public exploit code or active exploitation has been identified, and the payload is constrained to the victim's browser context (C:L/I:L), so a realistic outcome is limited session/data theft or UI manipulation rather than server compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier - including AEM as a Cloud Service and AEM 6.5 LTS - lets a low-privileged authenticated attacker execute arbitrary script in a victim's browser session, but only when two independent preconditions are met: the attacker holds a valid low-privilege AEM account and the victim is enticed into visiting a crafted URL or interacting with a manipulated page. The impact stays inside the victim's browser (low confidentiality and integrity, no availability loss, no server-side code execution), and the CVSS vector PR:L/UI:R confirms the authenticated, user-interaction-dependent attack path. Risk is low in practice: EPSS is 0.20% (9th percentile), the CVE is not in CISA KEV, and no public exploit has been identified at time of analysis.
RemediationAI
Upgrade to the fixed build published in Adobe's APSB25-115 security bulletin (https://helpx.adobe.com/security/products/experience-manager/apsb25-115.html); the source data does not enumerate the exact patched version, so confirm the corrected release for your track - on-premise/generic, AEM as a Cloud Service, or AEM 6.5 LTS - and move past 6.5.23. Because this is a DOM-based flaw that executes entirely client-side, signature-based WAF or network-IPS filtering offers little protection since the payload often never leaves the URL fragment; prioritize instead a strict Content Security Policy on AEM author and publish tiers that disallows 'unsafe-inline' and 'unsafe-eval' and constrains script-src to trusted origins - accepting that strict CSP can break inline scripts in custom components and may require nonce/hash refactoring. Additional compensating controls with their trade-offs: audit and sanitize custom components and client-side bundles for unsafe DOM sinks, restricting or reducing the population of low-privileged AEM accounts (the attack requires an authenticated low-privilege login, so tighter provisioning shrinks the attacker pool), and training authors to treat unexpected URLs as untrusted. These controls reduce attack surface but do not replace applying the vendor fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a DOM-based cross-site scripting flaw (CWE-79), meaning the malicious payload is never reflected by the AEM server but is instead processed by client-side JavaScript that reads attacker-controllable input - for example URL fragments, query parameters, or DOM state influenced by a crafted link - and writes it to a dangerous sink such as innerHTML, document.write, or an eval-like construct without sanitization. Because the vulnerable code runs in the browser, classic server-side input filtering and signature-based WAF inspection are largely ineffective; the payload typically lives after the '#' in the URL and never reaches the origin as a request. The CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N vector indicates network-borne delivery, low complexity, a required low-privileged authenticated account, mandatory victim interaction, and a scope change - scripts execute in the context of the vulnerable AEM origin, letting the attacker read or manipulate page content within the victim's session - but limited to low confidentiality and integrity impact with no availability effect. The CPE set identifies three affected tracks: the generic adobe:experience_manager product, the aem_cloud_service edition, and the 6.5 LTS release line, all at 6.5.23 or earlier.
Know when Experience Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-reachable web app with low-privilege authoring access (PR:L) and required victim interaction (UI:R); DOM-XSS crosses into browser session (S:C) with limited C:L/I:L and no availability impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim's browser. Exploitation of this issue requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)CVE.org
More in Experience Manager
View allSitecore Experience Manager, Platform, and Commerce versions 9.0 through 10.4 contain a Zip Slip vulnerability that allo
Sitecore PowerShell Extensions through version 7.0 allows authenticated users to upload arbitrary files including ASPX w
Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, wh
Adobe Experience Manager versions 6.5.23.0 and earlier contain a deserialization of untrusted data vulnerability that al
Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 through 10.4.1 contain a hardcoded administr
The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows r
Multiple Sitecore products allow remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remote
Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability. Rated critical severity (CVSS 9.8
Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerabilit
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), S
An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0
An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Comme
GitHub PoC
Exploit-DB