CVE-2025-64542: Cross-site Scripting (DOM-based XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2025-64542 describes a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. An attacker can exploit this by manipulating the Document Object Model (DOM) environment to execute arbitrary JavaScript code within the victim's browser. This requires the victim to interact by visiting a maliciously crafted webpage. The vulnerability changes the security scope and affects versions up to 6.5.24, SP2, and 2026.7.0. The CVSS v3.1 base score is 5.4, indicating medium severity with network attack vector, low attack complexity, low privileges required, and user interaction needed. The impact includes limited confidentiality and integrity loss but no availability impact.

Successful exploitation can lead to execution of malicious scripts in the context of the victim's browser, potentially allowing theft of sensitive information or session hijacking. The impact is limited to confidentiality and integrity with no direct availability impact. User interaction is required for exploitation, reducing the likelihood of automated attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify with Adobe if remediation is managed server-side. Until a patch or official fix is available, users should be cautious about visiting untrusted or suspicious links to reduce risk of exploitation.