Adobe Experience Manager CVE-2025-64541

Exploitation requires an authenticated low-privileged account on the AEM instance (PR:L - typically a content author or form-editing role) able to write into the vulnerable form fields, plus a victim who must actively browse to the page containing the injected field (UI:R). It affects default configurations of Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and the 6.5 LTS build per the CPE list, so no special feature toggle is needed - but the two gating factors (author-level authentication and victim page visit) meaningfully limit real-world exploitability. Impact is confined to script execution in the victim's browser (C:L/I:L); there is no server-side code execution or availability impact.

This is a genuinely low-to-medium priority issue despite affecting a widely-deployed enterprise CMS. Every risk signal points the same direction: the CVSS 3.1 base score is 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - exploitation requires low-privilege authentication (PR:L, i.e. an author/content-contributor account) AND victim interaction (UI:R, the victim must browse to the page), with only Low confidentiality and Low integrity impact and no availability impact. EPSS reinforces this: 0.25% probability at the 15th percentile, i.e. exploitation is statistically unlikely and this ranks in the bottom sixth of all CVEs. There is no CISA KEV listing and no public POC identified. There is no signal conflict here - the CVSS vector, EPSS, and lack of exploitation evidence are mutually consistent. No SSVC decision data was provided in the input. The scope change (S:C) is the only element inflating the score, reflecting that injected script executes in the victim's browser origin rather than the vulnerable component; this is standard for stored XSS and does not indicate server compromise. Net assessment: real but modest risk, gated behind an authenticated attacker and a clicking victim - not an emergency, but should be patched in normal cycles given AEM's role in enterprise content delivery.

A low-privileged AEM author account holder injects malicious JavaScript into a vulnerable form field, which is stored server-side. When a higher-privileged administrator, editor, or site visitor subsequently browses to the page rendering that field, the script executes in their browser session within the AEM origin, enabling session/cookie theft or actions on their behalf. No public exploit code has been identified at time of analysis, and successful attack requires both an authenticated foothold and victim interaction.