CVE-2025-64610: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2025-64610 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. It allows attackers with low privileges to inject malicious JavaScript into form fields that are stored and later rendered in users' browsers, potentially leading to script execution when victims access the affected pages. The vulnerability affects versions up to and including 2026.7.0, SP2, and 6.5.24. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, changed scope, and low impact on confidentiality and integrity, with no impact on availability.

An attacker with low privileges can exploit this vulnerability to execute malicious scripts in the browsers of users who visit the affected pages. This can lead to unauthorized actions or data exposure within the context of the affected application. The scope change suggests that the vulnerability may affect components beyond the initial privilege boundary. However, there are no known exploits in the wild at this time.

No official patch or remediation details are provided in the available data. Since this is a cloud service, Adobe typically manages remediation server-side. Users should check Adobe's official advisory for current patch status and remediation guidance. Until a fix is confirmed, avoid using vulnerable form fields or restrict access to trusted users where possible.