CVE-2025-64618: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2025-64618 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. It enables an attacker with low privileges to inject malicious JavaScript code into form fields that are stored and later rendered in a victim's browser. This can lead to script execution in the context of the affected application, potentially compromising confidentiality and integrity of user data. The vulnerability affects versions up to 6.5.24, SP2, and 2026.7.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, with low confidentiality and integrity impact and no availability impact.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the affected application for users who visit the vulnerable pages. This can lead to information disclosure and manipulation of data within the user's session. The scope change indicates that the vulnerability may affect resources beyond the initially vulnerable component. There is no known exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, verify if Adobe has applied server-side patches or mitigations. Until a fix is confirmed, avoid using or exposing vulnerable form fields to untrusted users. Monitor official Adobe communications for updates and apply any recommended patches or configuration changes promptly.