Adobe Experience Manager CVE-2025-64537

Requires user interaction (UI:R): a victim - typically an authenticated AEM user - must visit an attacker-crafted malicious page or follow a crafted link/parameter that reaches a vulnerable DOM sink, at which point injected script runs in the AEM origin and enables session takeover. No attacker authentication is needed (PR:N), and default configurations of Adobe Experience Manager 6.5.23 and earlier (including AEM Cloud Service and 6.5 LTS per CPE) are affected. The primary limiting factor is the mandatory victim interaction; value to an attacker is highest when the victim holds a privileged/author session and the AEM instance is reachable by the lure.

This is a genuinely serious-looking CVSS 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) driven by network vector, low complexity, no privileges, and a scope change (S:C) reflecting DOM-based XSS crossing the trust boundary into the victim's authenticated AEM session. However, the practical-risk signals are more moderate: EPSS is only 0.74% (53rd percentile), the flaw is NOT in CISA KEV, and no public POC is referenced - so exploitation status is 'no public exploit identified at time of analysis.' The 9.3 is partly inflated by the S:C scope change and by counting session takeover as full C:H/I:H; real-world exploitation is gated by mandatory user interaction (UI:R - victim must visit a crafted page) and by the attacker needing a valid injection vector against a specific AEM instance. Note a labeling conflict: the input carries an 'RCE' tag and the description says 'arbitrary code execution,' but the mechanism is DOM XSS executing JavaScript in the browser context (session takeover), NOT operating-system-level remote code execution - this should not be triaged as server-side RCE. Net: a real but not emergency priority - patch on normal cadence, prioritized higher for internet-facing AEM author/publish instances.

An attacker crafts a malicious web page (or a link/parameter that reaches a vulnerable AEM DOM sink) and lures an authenticated AEM user to visit it. When the victim's browser processes the attacker-controlled input, injected JavaScript executes in the AEM origin, letting the attacker steal the session and act as that user. No public exploit code is referenced at time of analysis, and success depends on the victim clicking/visiting the crafted page.