Adobe Experience Manager
CVE-2025-64543
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged AEM account
-
DeliveryCraft URL with malicious DOM payload
-
ExploitLure victim to click crafted link
-
ExecutionScript executes in victim browser (AEM origin)
-
ImpactSteal session/act as victim in AEM UI
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a low-privileged authenticated account on Adobe Experience Manager (PR:L) AND victim user interaction (UI:R) - the victim must visit an attacker-crafted URL or interact with a manipulated page for the DOM-based payload to execute. Affects AEM 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS. Impact is confined to the victim's browser session (C:L/I:L, no availability impact, no server-side code execution). These dual gates - needing both credentials and a successful social-engineering click - substantially limit realistic exploitation despite the network attack vector. |
| Impact | This is a genuine but LOW-priority vulnerability. The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) is self-consistent and modest: exploitation requires low-level authentication (PR:L) AND victim user interaction (UI:R), and the impact is limited to C:L/I:L (script execution in the victim's browser context, not server compromise). EPSS reinforces the low urgency at 0.25% (15th percentile), among the lowest exploitation-probability tiers. There is no CISA KEV listing and no public POC identified. No SSVC decision data was provided in the input. All signals align coherently here - moderate-to-low CVSS, very low EPSS, no active exploitation, no exploit code - so there is no conflict to reconcile. This is a real-but-low-risk client-side XSS that should be patched on a routine cadence rather than treated as an emergency. Note this CVE belongs to Adobe bulletin APSB25-115, which bundles multiple AEM XSS issues; some siblings (e.g. CVE-2025-64539/64537) scored 9.3 due to unauthenticated access and high impact, but THIS one is deliberately scoped lower by its PR:L and C:L/I:L metrics. |
| Exploit ScenarioDerived | A low-privileged AEM author/user crafts a malicious URL (or a manipulated page) that, when visited by a victim, triggers DOM-based JavaScript execution in the victim's browser within the AEM origin. No public POC has been identified. Because both authentication (PR:L) and victim interaction (UI:R) are required, exploitation depends on social-engineering the target into clicking the crafted link. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS lets a low-privileged authenticated attacker execute arbitrary script in a victim's browser session when that victim visits a crafted URL or interacts with a manipulated page. Exploitation requires two independent gates: a valid low-privileged AEM account (PR:L) and successful social engineering of the victim (UI:R), and the impact stays confined to the victim's browser context with no availability loss and no server-side code execution. There is no public exploit identified at time of analysis and no evidence of active exploitation; EPSS is 0.25% (15th percentile), consistent with a genuine but low-priority issue rather than an urgent one.
RemediationAI
Apply the fix documented in Adobe's security bulletin APSB25-115 (https://helpx.adobe.com/security/products/experience-manager/apsb25-115.html); for the on-premise/LTS track this means moving off the affected 6.5.23-and-earlier range to the corrected release named in that advisory, and for AEM Cloud Service it means ensuring the automatically delivered hotfix or updated cloud version is in place. Patch status at time of analysis is best described as available per vendor advisory, with the exact fixed build specified only in Adobe's bulletin rather than in the CVE metadata. If immediate upgrade is not possible, the most effective compensating control is a tested Content-Security-Policy that blocks inline and untrusted script execution on AEM authoring and publish surfaces - deploy it in report-only mode first, because strict CSP commonly breaks AEM's own client-side editor components and third-party integrations. Restricting network access to AEM author instances through VPN, IP allowlisting, or a reverse proxy reduces exposure but breaks legitimate remote authoring workflows and adds administrative overhead, and pinning down who holds low-privileged AEM accounts via least-privilege review directly removes the PR:L precondition. Because the attack still requires the victim to visit a crafted URL or manipulated page, user awareness training about unsolicited AEM links is a useful secondary control, and client-side sanitization or validation of URL fragments and DOM sinks should be treated only as interim hardening until the official patch is applied.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a DOM-based cross-site scripting condition (CWE-79) in Adobe Experience Manager's client-side JavaScript, where attacker-controllable input - for example a URL fragment, query parameter, or manipulated page content - is consumed by a dangerous DOM sink such as innerHTML, document.write, or an eval-style handler and rendered as executable markup inside the victim's browser rather than being handled server-side. Because the vulnerability lives in the DOM, the payload is assembled and executed entirely in the browser, so traditional server-side output encoding does not stop it; the CVSS scope change (S:C) reflects that the vulnerable component (AEM's page/UI code) and the impacted component (the victim's authenticated browser session) are different security authorities. The CPE strings confirm the affected code base spans multiple deployment models: the 6.5 track including the 6.5 LTS branch, the AEM Cloud Service offering, and the general Experience Manager 6.5 family, meaning both on-premise/LTS and managed-cloud tenants share the flaw. The CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N vector indicates a network-reachable, low-complexity attack that still needs authenticated AEM access and victim interaction, with only low confidentiality and integrity impact and no availability impact.
Know when Experience Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-reachable AEM UI with low complexity; PR:L because a low-privileged account is required, UI:R for the crafted-link click, S:C as script runs in the browser origin, C:L/I:L limited client-side impact, A:N.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim's browser. Exploitation of this issue requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)CVE.org
More in Experience Manager
View allSitecore Experience Manager, Platform, and Commerce versions 9.0 through 10.4 contain a Zip Slip vulnerability that allo
Sitecore PowerShell Extensions through version 7.0 allows authenticated users to upload arbitrary files including ASPX w
Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, wh
Adobe Experience Manager versions 6.5.23.0 and earlier contain a deserialization of untrusted data vulnerability that al
Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 through 10.4.1 contain a hardcoded administr
The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows r
Multiple Sitecore products allow remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remote
Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability. Rated critical severity (CVSS 9.8
Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerabilit
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), S
An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0
An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Comme
GitHub PoC
Exploit-DB