Adobe Experience Manager CVE-2025-64547

Exploitation requires the attacker to hold low-privileged authenticated access to AEM with the ability to write to a vulnerable form field (PR:L), and a separate victim must subsequently browse to the page rendering that field (UI:R) for the stored script to execute. This is stored/persistent XSS, so the payload survives until the field is remediated. Affected deployments are Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and the 6.5 LTS line (per CPE). Limiting factors: the two-actor requirement (authenticated injector plus interacting victim) and the capped C:L/I:L, A:N impact - script runs only in the victim's browser context, not the server, so there is no direct server-side code execution.

This is a genuine but low-priority issue. The CVSS 3.1 base score of 5.4 (Medium) is well-calibrated: while the attack vector is network (AV:N) with low complexity (AC:L), exploitation is double-gated by requiring low-privilege authentication (PR:L) and victim user interaction (UI:R), and the impact is limited to low confidentiality and integrity (C:L/I:L, A:N) even with scope change (S:C) reflecting script execution in the victim's browser origin. Corroborating signals reinforce the low real-world urgency: EPSS is 0.20% (9th percentile), among the lowest exploitation-probability tiers, there is no CISA KEV listing, and no public proof-of-concept was identified. The signals are internally consistent - no conflict between the CVSS vector, the description, and the exploitation-likelihood data. This is a legitimate stored XSS worth patching in a routine cycle, but it is NOT a high-CVSS-but-low-real-risk misclassification, nor an under-scored sleeper; it is simply a modest-severity, low-likelihood flaw. It is one of several near-identical XSS entries in Adobe's APSB25-115 bulletin.

A low-privileged authenticated user (e.g., a content author or form editor) injects a malicious JavaScript payload into a vulnerable AEM form field, which is persistently stored. When another user - such as an administrator or reviewer - later browses to the page rendering that field, the script executes in their browser session within the AEM origin, enabling session/cookie theft or actions on their behalf. No public exploit code was identified at time of analysis, and the attack requires the victim to navigate to the affected page.