CVE-2025-64830 Adobe CVE debrief

Who should care

Defenders responsible for Adobe Experience Manager instances, particularly those with versions prior to 6.5.25.0 or AEM Cloud Service versions prior to 2026.8.0, should assess exposure and apply patches or compensating controls as needed.

Why it matters

Defenders should care about CVE-2025-64830 because it is a stored XSS vulnerability in Adobe Experience Manager that could allow low-privileged attackers to inject malicious scripts into form fields, potentially leading to unauthorized script execution in victims' browsers. Defenders responsible for Adobe Experience Manager instances should assess exposure, particularly for versions prior to 6.5.25.0 and AEM Cloud Service versions prior to 2026.8.0, and apply patches or compensating controls as needed. The remediation priority is medium due to the CVSS score of 5.4.

• Defenders need to verify and prioritize patching of vulnerable Adobe Experience Manager instances to prevent potential script injection.
• Low-privileged attackers could exploit this vulnerability to inject malicious scripts, potentially leading to unauthorized script execution in victims' browsers.
• Defenders should monitor for suspicious activity or exploitation attempts targeting this vulnerability.
• Remediation priority is medium due to the CVSS score of 5.4 and the potential for script injection.

Technical summary

The vulnerability exists in Adobe Experience Manager, affecting its form fields. A low-privileged attacker could inject malicious scripts, which may be executed in a victim's browser when they access the page with the vulnerable field. The scope of the vulnerability has been changed. Defenders should prioritize assessing exposure and applying patches for Adobe Experience Manager, particularly for versions prior to 6.5.25.0 and AEM Cloud Service versions prior to 2026.8.0. The remediation priority is medium due to the CVSS score of 5.4.

Defensive priority

Defenders should prioritize assessing exposure and applying patches for Adobe Experience Manager, particularly for versions prior to 6.5.25.0 and AEM Cloud Service versions prior to 2026.8.0.

Recommended defensive actions

• Assess exposure of Adobe Experience Manager instances, particularly versions prior to 6.5.25.0 and AEM Cloud Service versions prior to 2026.8.0
• Apply patches or updates provided by Adobe to vulnerable instances
• Monitor for suspicious activity or exploitation attempts
• Verify and implement compensating controls if patches cannot be applied immediately
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 5.4 and severity of MEDIUM. Adobe has released a vendor advisory (APSB26-98) addressing this issue. The vulnerability exists in Adobe Experience Manager, affecting its form fields. A low-privileged attacker could inject malicious scripts, which may be executed in a victim's browser when they access the page with the vulnerable field.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.