CVE-2025-64584: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2025-64584 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. It permits a low-privileged attacker to inject malicious JavaScript into form fields that are stored and later rendered in a victim's browser, potentially leading to script execution in the context of the affected application. The vulnerability affects multiple versions of the product, including versions up to 6.5.24, SP2, and 2026.7.0. The CVSS 3.1 base score is 5.4, indicating medium severity, with attack vector network, low attack complexity, low privileges required, user interaction required, and scope changed. No known exploits in the wild or patch information is provided.

Successful exploitation allows an attacker with low privileges to inject and execute malicious scripts in the browsers of users who visit affected pages, potentially leading to information disclosure or session hijacking. The impact is limited to confidentiality and integrity with no availability impact reported. The scope is changed, indicating the vulnerability affects resources beyond the initial security boundary.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is not a cloud-hosted service, remediation depends on vendor updates or patches. Until a patch is available, restrict access to vulnerable form fields and apply input validation or sanitization where possible to reduce risk.