Adobe Experience Manager CVE-2025-64546

Requires an authenticated low-privileged account on the Adobe Experience Manager instance (PR:L) with the ability to submit content into affected form fields, plus a victim who subsequently browses to the page rendering that field (UI:R). Affected deployments are AEM 6.5.23 and earlier, including AEM Cloud Service and the 6.5 LTS build per the CPE strings. Exploitation is limited by these two gates - attacker must already hold form-authoring/contributor access and the injected page must be viewed by another user - and impact is bounded to Low confidentiality and Low integrity in the victim's browser (client-side script execution, not server-side RCE).

This is a genuine but low-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) is double-gated: it requires an authenticated low-privileged attacker (PR:L) to inject the payload AND a victim to browse to the affected page (UI:R), with only Low confidentiality and integrity impact and no availability impact. EPSS is very low at 0.20% (9th percentile), consistent with a stored XSS in an authoring/enterprise CMS rather than a mass-exploited flaw. There is no CISA KEV listing and no public exploit identified at time of analysis - signals align (low EPSS, no KEV, no POC), so nothing is conflicting here. This is a real-but-modest finding: standard XSS remediation priority, not an emergency. The stored nature (payload persists in form fields, S:C scope change into the victim browser context) makes it more durable than reflected XSS, which is the one factor that argues against fully deprioritizing it.

A low-privileged AEM user (e.g. a form author or content contributor) injects a malicious JavaScript payload into a vulnerable form field. The script is stored and later executes in the browser of any victim - such as an administrator or reviewer - who navigates to the page rendering that field, enabling session token theft or actions in the victim's authenticated context. No public exploit code is identified at time of analysis.