CVE-2025-64830: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2025-64830 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. It enables a low-privileged attacker to inject malicious JavaScript into vulnerable form fields. When a victim browses to the page containing the injected script, the malicious code executes in their browser. The vulnerability affects versions up to and including 2026.7.0, SP2, and 6.5.24. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, changed scope, and low impact on confidentiality and integrity, with no impact on availability.

An attacker with low privileges can inject malicious scripts that execute in the context of other users' browsers, potentially leading to information disclosure or manipulation of user interactions within Adobe Experience Manager as a Cloud Service. The changed scope suggests the vulnerability affects components beyond the initially targeted area. The impact on confidentiality and integrity is low, and availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe may manage remediation server-side. Users and administrators should monitor Adobe's official advisories for updates and apply any provided patches or mitigations promptly.