CVE-2025-64620: Adobe Experience Manager · Cross-site Scripting
Affects Adobe Experience ManagerSource CVE Database V5
Not known to be exploited · CVSS 5.4 Medium.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 16% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 10 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Adobe Adobe Experience Manager | Affected
| Fixed in– |
AI-suggested
To mitigate CVE-2025-64620 effectively, European organizations should: 1) Monitor Adobe's official channels closely and apply security patches or updates as soon as they become available for AEM versions 6.5.23 and earlier. 2) Implement strict input validation on all form fields to reject or sanitize potentially malicious scripts before storage. 3) Employ robust output encoding/escaping mechanisms when rendering user-supplied data in web pages to prevent script execution. 4) Deploy Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts and reduce the impact of XSS attacks. 5) Conduct regular security audits and penetration testing focused on web application vulnerabilities, including stored XSS. 6) Use web application firewalls (WAFs) with updated rules to detect and block malicious payloads targeting known AEM vulnerabilities. 7) Educate developers and administrators on secure coding practices and the risks of XSS. 8) Monitor logs and user behavior for anomalies that may indicate exploitation attempts. 9) Consider isolating or restricting access to vulnerable AEM instances until patches are applied. These measures, combined, reduce the attack surface and limit the potential damage from exploitation.
Description
CVE-2025-64620 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.23 and earlier. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields, which executes in the browser of any user visiting the affected page. This vulnerability requires user interaction and privileges to submit data but can lead to confidentiality and integrity impacts by stealing session tokens or manipulating page content. The CVSS score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, and partial confidentiality and integrity impact. No known exploits are currently reported in the wild. European organizations using AEM for content management and web delivery are at risk, especially those with public-facing portals. Mitigation involves applying patches when available, implementing strict input validation and output encoding, employing Content Security Policy (CSP), and monitoring for suspicious activity.