Adobe Experience Manager CVE-2025-64538

Exploitation requires user interaction (UI:R): a victim - realistically an authenticated AEM author/user whose session is worth taking over - must visit an attacker-crafted malicious page or click a crafted link that feeds attacker-controlled input into a vulnerable client-side DOM sink in AEM. No authentication is required of the attacker (PR:N) and no special AEM server configuration is named in the advisory, so default deployments of AEM 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS are in scope. The primary limiting factor is the social-engineering step needed to make a victim load the malicious content; impact (session takeover) is greatest against users already holding valuable AEM sessions.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, base 9.3) describes a network-reachable, low-complexity, unauthenticated DOM-based XSS whose only gating factor is user interaction (the victim must visit a crafted page). The high score is driven by the scope change (S:C) plus C:H/I:H, which Adobe justifies via session takeover - realistic for XSS in an authoring/CMS context. However, the real-world exploitation signals are muted: EPSS is only 0.64% (48th percentile), there is no CISA KEV listing (no confirmed active exploitation), and no public exploit code was identified at time of analysis. This is a case where a high CVSS score reflects potential impact rather than demonstrated exploitation likelihood - the UI:R requirement and the need to socially engineer a victim into loading attacker-controlled DOM content meaningfully lower practical risk versus a no-interaction flaw. Note also that the 'arbitrary code execution' language and the 'RCE' tag are misleading: this is client-side script execution in the victim's browser (session takeover), not server-side code execution on the AEM host. Treat as a medium-priority patch item: genuinely impactful if a targeted phishing/social-engineering chain succeeds against authenticated AEM users, but not evidence of mass or automated exploitation.

An attacker crafts a malicious web page (or a link with attacker-controlled DOM sink input) and lures an authenticated AEM user into visiting it; the injected script executes in the victim's browser in the AEM origin context, allowing session token/cookie theft and session takeover. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means the technical bar is low once a victim is induced to click. Success hinges entirely on the required user interaction.