CVE-2025-64542: experience manager 6.5; +3 more affected products

CVE-2025-64542. CVSS 3.1 base score 5.4 (MEDIUM, Vendor/CNA). EPSS 0.00255 (percentile 0.16051), scored 19-Oct-2026.

Affected technology

experience manager · before 6.5 (exclusive)
adobe

experience manager · before 6.5.25.0 (exclusive)
adobe

experience manager · before 2026.8.0 (exclusive)
adobe

experience manager · 6.5
adobe

experience manager · 6.5 · update sp1
adobe

experience manager · 6.5 · update sp2
adobe

Adobe Experience Manager as a Cloud Service · 0 through 2026.7.0
Adobe

Adobe Experience Manager 6.5 LTS · 0 through SP2
Adobe

Adobe Experience Manager 6.5 · 0 through 6.5.24
Adobe

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Vendor/CNA’s CVSS 3.1 assessment (base score 5.4/10) rates confidentiality and integrity impact as low; availability impact as none.

Published 20-Oct-2026 01:48 UTC

CWE: CWE-79
CCR priority: 21.7 /100 (P4)
CVSS 3.1: 5.4 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · Vendor/CNA
EPSS: 0.00255 · percentile 0.16051 · 2026-10-19
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-20 01:44:01.123206+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2025-64542.html