CVE-2025-46958: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-46958 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.22 and earlier. The vulnerability was disclosed in August 2025 and could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields (AttackerKB, Adobe Security).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) vulnerability with a CVSS v3.1 Base Score of 5.4 (Medium). The attack vector is network-based (AV:N), requires low attack complexity (AC:L), low privileges (PR:L), and user interaction (UI:R). The scope is changed (S:C) with low impact on both confidentiality and integrity (C:L, I:L) and no impact on availability (A:N) (AttackerKB).

When successfully exploited, the vulnerability allows malicious JavaScript to be executed in a victim's browser when they browse to the page containing the vulnerable field. This could lead to unauthorized access to user data, session hijacking, or other client-side attacks (AttackerKB).

Adobe has released security updates to address this vulnerability. Organizations are advised to update to the latest version of Adobe Experience Manager. The vulnerability is fixed in versions after 6.5.22 (Adobe Security).