CVE-2025-64866: Adobe Experience Manager XSS Vulnerability

CVE-2025-64866 Overview

Adobe Experience Manager (AEM) contains a stored Cross-Site Scripting (XSS) vulnerability tracked as CVE-2025-64866. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when the victim loads the page containing the injected field. The vulnerability carries a changed scope, meaning the impact extends beyond the vulnerable component itself.

The issue is classified under [CWE-79]: Improper Neutralization of Input During Web Page Generation. Adobe has documented the flaw in Adobe Security Advisory APSB26-98.

Critical Impact

Authenticated attackers can execute arbitrary JavaScript in victim browsers, enabling session theft, credential harvesting, and unauthorized actions against the AEM interface.

Affected Products

• Adobe Experience Manager (AEM)
• See Adobe Security Advisory APSB26-98 for affected versions
• Both Cloud Service and on-premises deployments may be impacted

Discovery Timeline

• 2026-09-08 - CVE-2025-64866 published to NVD
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2025-64866

Vulnerability Analysis

The vulnerability is a stored (persistent) XSS flaw within Adobe Experience Manager form fields. Stored XSS occurs when user-supplied input is saved to server-side storage without adequate sanitization or output encoding. When another user later renders the affected page, the injected script executes with the privileges of the victim's browser session.

Because the CVE record indicates a changed scope, the injected script can affect resources beyond the vulnerable component. In an authoring or publishing environment such as AEM, this can translate into attacks against administrative users viewing content submitted by lower-privileged authors or form contributors.

Exploitation requires the attacker to hold a valid low-privileged account and requires user interaction from the victim, typically navigating to the page containing the tainted field.

Root Cause

The root cause is improper neutralization of user input during web page generation [CWE-79]. Form field values submitted by authenticated users are stored and later rendered without proper HTML entity encoding or context-aware output escaping. Consult the Adobe Security Advisory APSB26-98 for component-level detail.

Attack Vector

The attack is remotely reachable over the network. An authenticated attacker with low privileges submits crafted JavaScript payloads through a vulnerable form field. The malicious content persists in AEM storage. When a legitimate user, potentially with higher privileges, loads the rendered page, the browser executes the attacker's script under the origin of the AEM instance. Consequences include session token theft, forced actions via the AEM API, and pivoting into administrative workflows.

No public proof-of-concept exploit code is available at this time. Refer to the vendor advisory for technical specifics.

Detection Methods for CVE-2025-64866

Indicators of Compromise

• Unexpected <script> tags, event handlers such as onerror= or onload=, or javascript: URIs stored inside AEM content nodes or form submissions
• Outbound HTTP requests from authenticated author or admin sessions to unfamiliar external domains, indicating possible cookie or token exfiltration
• Anomalous content modifications performed by low-privileged accounts on pages later accessed by privileged users

Detection Strategies

• Inspect AEM repository content and form submission logs for HTML or JavaScript syntax in fields that expect plain text
• Deploy Content Security Policy (CSP) reporting to surface script execution originating from unexpected inline sources
• Correlate low-privileged content edits with subsequent privileged-user page views to identify potential targeting patterns

Monitoring Recommendations

• Enable verbose access and audit logging on AEM author instances, focusing on form submissions and content updates
• Forward AEM logs and web proxy telemetry to a centralized analytics platform such as Singularity Data Lake for correlation and retention
• Alert on browser session anomalies from privileged AEM users, including new geolocations, user-agents, or elevated request volumes

How to Mitigate CVE-2025-64866

Immediate Actions Required

• Apply the security update referenced in Adobe Security Advisory APSB26-98 to all affected AEM instances
• Audit existing content and form submissions for stored script payloads before restoring services
• Rotate session tokens and administrative credentials if suspicious content or activity is discovered

Patch Information

Adobe has published fixed versions under advisory APSB26-98. Administrators should review the advisory to identify the specific product version and channel (AEM Cloud Service, AEM 6.5, or AEM Forms) applicable to their deployment and apply the corresponding update.

Workarounds

• Restrict form-authoring privileges to trusted users until patches are deployed
• Enforce a strict Content Security Policy that blocks inline script execution on AEM-rendered pages
• Place a web application firewall (WAF) in front of AEM to filter script-like payloads in form submissions
• Review and harden output-encoding configurations in custom AEM components that render user-supplied content

# Example CSP header restricting inline script execution
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'