CVE-2025-64589: Adobe Experience Manager XSS Vulnerability

CVE-2025-64589 Overview

Adobe Experience Manager (AEM) contains a stored Cross-Site Scripting (XSS) vulnerability tracked as CVE-2025-64589. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. When a victim browses the page containing the tainted field, the payload executes in their browser session. The flaw is classified under CWE-79 and carries a changed scope, meaning impact can extend beyond the vulnerable component.

Critical Impact
Attackers with low privileges can persist JavaScript payloads in AEM forms, hijacking sessions and performing actions in the browser context of higher-privileged users who load the affected pages.

Affected Products

Adobe Experience Manager (AEM)
Refer to Adobe Security Advisory APSB26-98 for affected version ranges
Both AEM Cloud Service and on-premise deployments should be reviewed against the advisory

Discovery Timeline

2026-09-08 - CVE-2025-64589 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2025-64589

Vulnerability Analysis

CVE-2025-64589 is a stored XSS flaw in Adobe Experience Manager form-field handling. The application accepts user-supplied input into form fields without adequately sanitizing or encoding HTML and JavaScript content. AEM persists the tainted value in its content repository. When any subsequent visitor loads a page rendering the stored field, the browser parses and executes the attacker-controlled script.

Because the CVSS scope is marked as changed, the impact reaches components beyond the vulnerable form component. This typically means the injected script can access authenticated sessions or perform actions against protected resources within the same origin. User interaction is required, as a victim must load the affected page for the payload to fire.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. AEM stores form-field values without enforcing context-aware output encoding at render time. Any attacker with authoring or form-submission privileges can smuggle <script> tags or event-handler attributes into persisted content.

Attack Vector

The attack vector is network based and requires low privileges plus victim interaction. An authenticated attacker submits a JavaScript payload through a vulnerable form field. AEM stores the value in the repository. When an administrator, author, or other user browses the page rendering that field, the payload executes with the victim's session context. This enables session token theft, forced actions on behalf of the victim, and content defacement within AEM.

No verified public exploit code is available. See the Adobe Security Advisory APSB26-98 for vendor-provided technical details.

Detection Methods for CVE-2025-64589

Indicators of Compromise

Unexpected <script>, onerror, onload, or javascript: strings persisted in AEM form-field content nodes within the JCR repository
HTTP POST requests to AEM form submission endpoints containing encoded script payloads or HTML control characters
Outbound browser requests from author or admin sessions to unfamiliar domains shortly after loading AEM pages
Session tokens or CSRF tokens appearing in referer headers or third-party access logs

Detection Strategies

Audit AEM content repository nodes for HTML markup or scripting syntax stored in fields expected to hold plain text
Review AEM request.log and dispatcher access logs for form submissions containing script tags, angle brackets, or common XSS payload signatures
Instrument a Content Security Policy (CSP) in report-only mode to surface inline script violations originating from AEM-rendered pages

Monitoring Recommendations

Forward AEM application, dispatcher, and reverse proxy logs to a centralized analytics platform for correlation
Alert on anomalous authoring activity from low-privileged accounts, especially bulk form submissions or edits to shared components
Monitor browser-side CSP violation reports to detect exploitation attempts against internal AEM users

How to Mitigate CVE-2025-64589

Immediate Actions Required

Apply the fixed AEM version referenced in Adobe Security Advisory APSB26-98 as soon as possible
Inventory all AEM instances, including staging and development environments, and confirm patch status
Review recent form submissions and audit logs for suspicious script content that may have been planted before patching
Rotate session tokens and credentials for any AEM administrators who accessed potentially tainted pages

Patch Information

Adobe has published patched builds in advisory APSB26-98. Administrators should follow the version guidance in the Adobe Security Advisory APSB26-98 and validate the update against internal change-management procedures before promoting to production.

Workarounds

Restrict form-authoring and form-submission privileges to trusted accounts until the patch is applied
Deploy a strict Content Security Policy that disallows inline scripts and untrusted script sources on AEM-rendered pages
Configure the AEM dispatcher and web application firewall to filter HTML control characters in form-field parameters where feasible
Enable HttpOnly and Secure flags on session cookies to reduce the impact of stolen session identifiers

bash

# Example CSP header applied at the AEM dispatcher or reverse proxy
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"