CVE-2025-64796: Adobe Experience Manager · Cross-site Scripting
Affects Adobe Experience ManagerSource CVE Database V5
Not known to be exploited · CVSS 5.4 Medium.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 16% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 10 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Adobe Adobe Experience Manager | Affected
| Fixed in– |
AI-suggested
- Monitor Adobe's official channels for patches or security updates addressing CVE-2025-64796 and apply them promptly once available.
- Implement strict input validation on all form fields to sanitize and reject malicious scripts before storage.
- Employ robust output encoding/escaping techniques to ensure that any user-supplied data rendered in web pages cannot execute as code.
- Deploy Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts and reduce the impact of potential XSS payloads.
- Conduct regular security audits and penetration testing focused on input handling and XSS vulnerabilities within AEM implementations.
- Educate users and administrators about the risks of phishing and social engineering that could facilitate exploitation.
- Use web application firewalls (WAFs) with updated rulesets to detect and block malicious payloads targeting known vulnerable endpoints.
- Limit privileges of users who can submit data to vulnerable forms to reduce the attack surface.
- Review and harden AEM configurations to minimize exposure of vulnerable components.
- Implement logging and monitoring to detect suspicious activities indicative of exploitation attempts.
Description
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.