CVE-2025-64610: Adobe Experience Manager XSS Vulnerability

CVE-2025-64610 Overview

Adobe Experience Manager (AEM) contains a stored Cross-Site Scripting (XSS) vulnerability tracked as CVE-2025-64610. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. When a victim browses to a page containing the injected field, the script executes in their browser context. The scope changes because code runs outside the vulnerable component's security boundary, affecting other resources. Adobe disclosed the issue in Security Bulletin APSB26-98 and classified it under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers with low privileges can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, and unauthorized actions performed as the victim user.

Affected Products

Adobe Experience Manager (AEM) — versions listed in Adobe Security Bulletin APSB26-98
AEM Cloud Service deployments referenced in the vendor advisory
On-premise AEM installations exposing vulnerable form fields

Discovery Timeline

2026-09-08 - CVE-2025-64610 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2025-64610

Vulnerability Analysis

The flaw is a stored XSS issue in Adobe Experience Manager form field handling. AEM fails to properly neutralize user-supplied input before persisting it and rendering it back in the browser. An authenticated attacker with low-level privileges submits crafted payloads containing HTML or JavaScript into affected form fields. AEM stores the payload without sufficient encoding or sanitization.

When another user, including administrators or unauthenticated visitors, loads a page that displays the stored content, the browser parses and executes the injected script. Exploitation requires user interaction because the victim must navigate to the affected page. The scope changes, meaning the injected script executes with authority beyond the vulnerable component and can affect other origins or session contexts within AEM.

Root Cause

The root cause is improper output encoding of form field data rendered into HTML responses. AEM does not apply context-aware escaping when writing stored input into the DOM. This maps to [CWE-79], where server-side code inserts untrusted data into an HTML context without HTML entity encoding or a sanitization allowlist.

Attack Vector

The attacker authenticates to AEM with a low-privileged account, such as a content contributor or form editor role. They submit a crafted payload targeting a vulnerable form field, embedding a <script> tag or event handler attribute such as onerror or onload. AEM persists the payload in the content repository.

When a victim opens the containing page, the browser renders the stored script. The script runs under the AEM origin and can access session cookies, invoke authenticated API endpoints, exfiltrate data, or modify page content. See the Adobe Security Bulletin APSB26-98 for vendor-specific exploitation notes.

Detection Methods for CVE-2025-64610

Indicators of Compromise

Form field values in the AEM content repository containing <script>, javascript:, or inline event handler attributes such as onerror=, onload=, or onclick=
Outbound HTTP requests from browser sessions to unfamiliar domains immediately after loading AEM-served pages
Unexpected session token or cookie access patterns from authenticated AEM user sessions
Content repository modifications by low-privileged accounts touching fields that render in shared or high-traffic pages

Detection Strategies

Audit AEM content repository nodes for stored payloads matching XSS signatures using JCR queries or content export scanning
Enable and monitor AEM access logs for POST or PUT requests to form endpoints containing suspicious characters such as <, >, or encoded equivalents
Deploy Content Security Policy (CSP) headers and monitor CSP violation reports for unexpected inline script execution
Correlate low-privileged user activity with subsequent authenticated actions performed under administrator sessions

Monitoring Recommendations

Log all form submissions with source user, target field, and payload metadata for retrospective review
Monitor DOM-level anomalies via browser instrumentation or web application firewall (WAF) telemetry
Track unusual JavaScript execution patterns on AEM-served pages, particularly script tags or event handlers not present in source templates
Ingest AEM audit logs into a centralized SIEM for correlation with authentication events and privilege changes

How to Mitigate CVE-2025-64610

Immediate Actions Required

Apply the security update referenced in Adobe Security Bulletin APSB26-98 to all AEM instances
Review recent content changes made by low-privileged accounts and remove any suspicious form field entries
Rotate session tokens and administrative credentials that may have been exposed to injected scripts
Restrict low-privileged account creation and audit existing role assignments for principle of least privilege

Patch Information

Adobe released fixes as part of Security Bulletin APSB26-98. Administrators should consult the Adobe advisory for the applicable version list and update instructions for both AEM Cloud Service and on-premise deployments.

Workarounds

Deploy a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins
Place a web application firewall (WAF) in front of AEM with rules to block XSS payloads in form submissions
Temporarily restrict access to affected form components until patches are applied
Review and tighten role-based access controls to limit which accounts can author content rendered on high-visibility pages

bash

# Example Content-Security-Policy header for AEM dispatcher configuration
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"