Adobe Experience Manager CVE-2025-64550

Requires an attacker to hold a low-privileged authenticated account in Adobe Experience Manager (PR:L) AND requires victim user interaction (UI:R) - specifically, the victim must visit a crafted URL or interact with a manipulated web page that triggers the client-side DOM sink. Affected deployments are AEM 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS (per CPE strings). Impact is confined to the victim's browser context (C:L/I:L, no server-side code execution and no availability impact). The double gate of authentication plus user interaction, combined with only low confidentiality/integrity impact, substantially limits realistic exploitation despite the network attack vector.

This is a genuinely low-priority issue despite being a 'CRITICAL product' finding. All signals align toward low real-world risk: CVSS 3.1 base score is 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - exploitation is double-gated by requiring both low-privileged authentication (PR:L) and victim user interaction (UI:R), and impact is limited to C:L/I:L with no availability effect. EPSS reinforces this: 0.22% probability at the 11th percentile, indicating very low predicted exploitation likelihood. The vulnerability is NOT in CISA KEV (no active exploitation), and no public POC is referenced - the only reference is Adobe's own advisory. There is no conflict between CVSS and description: the vector's PR:L and UI:R map cleanly onto the description's 'low privileged attacker' and 'requires user interaction such as visiting a crafted URL.' The scope change (S:C) is the sole factor lifting this above a pure ~3.x - justified because injected script executes in the victim's browser context across the AEM security boundary. Net: a real but low-severity client-side flaw, not an emergency. It should be patched on a routine cadence alongside the other APSB25-115 DOM-XSS fixes rather than escalated.

A low-privileged authenticated AEM user (e.g., a content author account) crafts a URL or manipulated page that carries a malicious DOM-XSS payload, then lures a victim AEM user into clicking it. When the victim's browser processes the crafted input client-side, the attacker's script runs in the victim's AEM session context, enabling session/token theft or actions on the victim's behalf. No public exploit code is identified at time of analysis, and exploitation depends on both attacker authentication and victim interaction.