CVE-2025-64854: Adobe Experience Manager XSS Vulnerability

CVE-2025-64854 Overview

Adobe Experience Manager (AEM) contains a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in form field handling. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they visit the page containing the injected field. The vulnerability has a changed scope, meaning the impact extends beyond the vulnerable component's security authority.

Critical Impact
Authenticated attackers with low privileges can persist malicious JavaScript in AEM form fields, enabling session theft, credential harvesting, or unauthorized actions performed in the context of higher-privileged victims who view affected pages.

Affected Products

Adobe Experience Manager (AEM) — refer to Adobe Security Advisory APSB26-98 for specific affected versions

Discovery Timeline

2026-09-08 - CVE-2025-64854 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2025-64854

Vulnerability Analysis

The vulnerability is a stored XSS flaw in Adobe Experience Manager form components. AEM fails to properly sanitize or encode user-supplied input submitted to certain form fields. The unsanitized input is persisted server-side and later rendered in the browser of any user who loads the affected page.

Because the payload is stored rather than reflected, exploitation does not require the attacker to lure the victim through a crafted link. Any user who visits the compromised page triggers execution of the attacker's JavaScript. The changed scope in the CVSS vector indicates the impact crosses security boundaries, likely affecting content authors, editors, or administrators who load the poisoned content in AEM's authoring interface.

Exploitation requires low-privileged authentication and victim interaction (loading the affected page). The confidentiality and integrity impacts are limited but sufficient to steal session tokens, perform CSRF-style actions, or pivot toward higher-value accounts within AEM.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. AEM's form field processing accepts script content without applying context-appropriate output encoding before rendering the value back into the HTML response.

Attack Vector

The attack is delivered over the network by an authenticated user with low privileges. The attacker submits a crafted payload containing HTML or JavaScript into a vulnerable form field. AEM stores the payload without adequate sanitization. When any subsequent user browses to the page rendering that field, the browser parses and executes the injected script under the origin of the AEM instance. See the Adobe Security Advisory APSB26-98 for vendor-provided technical details.

Detection Methods for CVE-2025-64854

Indicators of Compromise

Form field values in AEM content repositories containing <script> tags, javascript: URIs, or event handler attributes such as onerror=, onload=, or onmouseover=.
Unexpected outbound HTTP requests from author or publish nodes to attacker-controlled domains, indicating exfiltration of cookies or session tokens.
Anomalous authentication or privilege changes originating from author sessions shortly after content viewing activity.

Detection Strategies

Audit AEM JCR content nodes for form field properties containing HTML control characters or script-like patterns using repository queries.
Deploy Content Security Policy (CSP) reporting endpoints and monitor for script-src violations on AEM-served pages.
Correlate web server access logs with author account activity to identify unusual POST payloads targeting form endpoints.

Monitoring Recommendations

Enable AEM audit logging for content modifications and forward events to a centralized SIEM for retention and correlation.
Monitor browser telemetry and endpoint DNS logs for connections from author workstations to unfamiliar domains following AEM sessions.
Alert on privilege escalations, permission changes, or user account creation in AEM shortly after form submissions from low-privileged accounts.

How to Mitigate CVE-2025-64854

Immediate Actions Required

Apply the patch referenced in Adobe Security Advisory APSB26-98 to all AEM author and publish instances.
Review recent form submissions and stored content for injected script payloads and remove any malicious entries.
Rotate session tokens and require re-authentication for AEM users, prioritizing administrator and content author accounts.

Patch Information

Adobe published the fix in Security Advisory APSB26-98. Administrators should consult the advisory for the specific AEM versions and service pack levels that remediate CVE-2025-64854, and schedule updates for both author and publish tiers.

Workarounds

Restrict form field creation and editing permissions to a minimum set of trusted users until the patch is applied.
Deploy a strict Content Security Policy on AEM-served content to block inline script execution and limit script-src to trusted origins.
Place a Web Application Firewall (WAF) in front of AEM to filter form submissions containing HTML tags, script content, or event handler attributes.

bash

# Example Content Security Policy header to restrict inline script execution
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"