CVE-2025-64866: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2025-64866 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. It allows an attacker with low privileges to inject malicious JavaScript into form fields that are stored and later rendered in the application. When other users access the affected pages, the malicious script executes in their browsers, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 5.4, with network attack vector, low attack complexity, low privileges required, and user interaction required. The impact includes limited confidentiality and integrity loss without availability impact. The vulnerability affects versions up to and including 2026.7.0, SP2, and 6.5.24. No vendor advisory or patch information is provided, and no known exploits are reported.

The vulnerability allows execution of malicious JavaScript in the context of the victim's browser when visiting a page with the injected script. This can lead to limited confidentiality and integrity impacts, such as theft of session tokens or manipulation of page content. There is no impact on availability. The scope change indicates that the vulnerability may affect components beyond the initially vulnerable module.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Adobe's advisories for updates. Until a fix is available, consider restricting access to vulnerable form fields and applying input validation or output encoding as temporary mitigations if feasible.