Adobe Experience Manager CVE-2025-64544

Requires an authenticated low-privileged account on the AEM instance (PR:L) - not remotely reachable by fully anonymous attackers - AND victim user interaction (UI:R), specifically the victim visiting a crafted URL or interacting with a manipulated web page. Exploitation affects Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and the 6.5 LTS build. The DOM-based nature means the payload executes client-side in the victim's browser, so realistic impact is limited to that victim's session/browser context; the dual requirement of valid credentials plus a social-engineering step to trigger interaction significantly limits practical exploitation.

This is a genuinely low-priority issue despite the network attack vector. The CVSS 3.1 base score is 5.4 (Medium), and every corroborating signal points down rather than up. EPSS is 0.25% at the 15th percentile, indicating very low predicted exploitation likelihood. There is no CISA KEV listing (not actively exploited) and no public exploit code identified at time of analysis. The CVSS vector itself constrains impact: it requires an authenticated low-privileged attacker (PR:L) AND victim user interaction (UI:R), and the impacts are only C:L/I:L with no availability impact - consistent with a client-side DOM-based XSS that runs script in a single victim's browser rather than compromising the server. The S:C (scope change) reflects that injected script executes in the browser origin/security context beyond the vulnerable component, which is normal for XSS. Signals are internally consistent - there is no conflict between the description (DOM-based XSS, low-privileged attacker, requires user interaction) and the CVSS vector. The main residual risk is that AEM is an enterprise authoring platform, so a low-privileged content author account plus a targeted victim (e.g., another author/admin) could allow limited session or UI manipulation, but the double gating (authentication + interaction) and low impact metrics keep real-world risk modest.

A low-privileged authenticated AEM user crafts a malicious URL or manipulates a page parameter that the client-side JavaScript reflects unsafely into the DOM. They lure a victim (e.g., another authenticated user) into visiting the crafted URL, causing attacker-controlled script to execute in the victim's browser within the AEM origin. No public proof-of-concept exploit has been identified at time of analysis.