CVE-2025-64589: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2025-64589 is a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) in Adobe Experience Manager as a Cloud Service. It enables an attacker with low privileges to inject malicious JavaScript into form fields that are not properly sanitized. This script executes in the context of users who visit the affected pages, potentially leading to information disclosure or session hijacking. The vulnerability scope is changed, and it affects versions up to 2026.7.0, SP2, and 6.5.24. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An attacker with low privileges can inject malicious scripts into vulnerable form fields, which execute in the browsers of users who view the affected pages. This can lead to partial confidentiality and integrity impacts such as theft of session tokens or unauthorized actions performed on behalf of the user. There is no impact on system availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe may manage remediation server-side. Until a fix is confirmed, restrict access to vulnerable form fields and apply input validation or sanitization where possible. Monitor official Adobe advisories for updates and patches.