Adobe Experience Manager CVE-2025-64539

Requires a victim with an active/authenticated Adobe Experience Manager session (author or publish user) to visit an attacker-crafted malicious page or click a crafted link that triggers the DOM-based XSS sink (UI:R is mandatory). No attacker authentication is needed (PR:N), and it works against default configurations of affected AEM 6.5.23-and-earlier, AEM Cloud Service, and AEM 6.5 LTS deployments, but exploitation is limited to the victim's browser/session context - it does not by itself yield server or OS code execution. Practical limiting factors: the required user interaction, and the value of the vulnerability depending on the targeted victim already holding a privileged AEM session.

This is a genuine but user-interaction-gated web vulnerability rather than a drive-by critical. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, base 9.3) reflects a scope-changing DOM-based XSS: network reachable, low complexity, no privileges, but requiring victim interaction (UI:R). The high score is driven largely by the scope change (S:C) and the C:H/I:H session-takeover impact - but the mandatory UI:R materially lowers real-world exploitability versus a no-interaction critical. Corroborating signals point to modest urgency: EPSS is only 0.48% (39th percentile), there is no CISA KEV listing, and no public exploit was identified in the provided data - no public exploit identified at time of analysis. No SSVC decision data was provided. The 'RCE' tag is misleading: the underlying flaw is client-side script execution leading to session takeover, not server-side arbitrary code execution, so treating this as a server-compromise RCE would overstate the risk. Net: real but not top-priority - patch on a normal cycle, prioritize internet-facing AEM author/publish instances. No conflicts between attack vector and description (both indicate network delivery of a crafted page); the main caveat is that impact scope is browser/session-bound, not host takeover.

An attacker crafts a malicious web page (or a link/parameter that reaches a vulnerable AEM-served page) containing script that reaches a DOM sink and executes in the victim's browser under the AEM origin. When an authenticated AEM user (e.g., a content author or admin) visits the crafted page, the script runs in their session context and can hijack their session tokens for account/session takeover. No public exploit code was identified at time of analysis, and success depends on the victim clicking/visiting the malicious page.