CVE-2025-64618 Adobe CVE debrief

Who should care

Defenders responsible for Adobe Experience Manager instances, particularly those with versions prior to 6.5.25.0 and AEM Cloud Service versions prior to 2026.8.0, should assess exposure and apply patches. Low-privileged attackers could exploit this vulnerability to inject malicious scripts.

Why it matters

A stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager could allow a low-privileged attacker to inject malicious scripts into vulnerable form fields, potentially leading to execution of malicious JavaScript in a victim's browser. Defenders should prioritize assessing exposure and applying patches for affected versions.

• Defenders must assess exposure and apply patches for Adobe Experience Manager instances
• Low-privileged attackers could inject malicious scripts into vulnerable form fields
• Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field
• Verify affected versions and apply patches or compensating controls as needed

Technical summary

The vulnerability is a stored Cross-Site Scripting (XSS) issue in Adobe Experience Manager, which could allow a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. The CVSS score is 5.4, and the severity is MEDIUM. This issue affects Adobe Experience Manager versions prior to 6.5.25.0 and AEM Cloud Service versions prior to 2026.8.0. Adobe has released a vendor advisory (APSB26-98) with patches for the affected versions.

Defensive priority

Defenders should prioritize assessing exposure and applying patches for Adobe Experience Manager, particularly for versions prior to 6.5.25.0 and AEM Cloud Service versions prior to 2026.8.0.

Recommended defensive actions

• Assess exposure of Adobe Experience Manager instances, particularly versions prior to 6.5.25.0 and AEM Cloud Service versions prior to 2026.8.0
• Apply patches provided by Adobe (APSB26-98) for affected versions
• Monitor for suspicious activity and implement compensating controls as needed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 5.4 and severity of MEDIUM. Adobe has released a vendor advisory (APSB26-98) with patches for the affected versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.