Adobe Experience Manager
CVE-2025-64551
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege AEM account
-
DeliveryCraft URL with DOM-XSS payload
-
ExploitLure authenticated victim to click
-
ExecutionScript executes in victim browser context
-
ImpactSteal session data or perform limited actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a low-privileged authenticated account on the AEM instance (PR:L) AND victim user interaction (UI:R) - specifically the victim visiting a crafted URL or interacting with a manipulated web page that triggers the DOM-based sink. This is client-side script execution in the victim's browser within the AEM origin, not server-side code execution. Affected deployments are Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and the 6.5 LTS line. The double gate (authentication plus social-engineering/interaction) and Low-only C/I impact with no availability effect substantially limit realistic risk versus the raw network attack vector. |
| Impact | This is a high-CVSS-context product with a genuinely LOW real-world risk profile. The CVSS 3.1 base score of 5.4 (MEDIUM) is itself moderate, and the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N reflects a doubly-gated attack: it requires both low-privilege authentication (PR:L) AND victim user interaction (UI:R), with only Low confidentiality and integrity impact and no availability impact. EPSS reinforces the low-priority picture at 0.27% (18th percentile), indicating low predicted exploitation likelihood. There is no CISA KEV listing and no public POC identified. The signals are consistent rather than conflicting: a medium-scored, authentication-and-interaction-gated client-side XSS with limited impact. The scope change (S:C) - script executing in the victim browser context escaping the vulnerable component's security authority - modestly elevates the score but does not translate into server compromise. This is a routine hardening/patch-cycle item, not an emergency; prioritize it below the unauthenticated 9.3 DOM-XSS siblings in the same APSB25-115 batch (CVE-2025-64537, CVE-2025-64539). |
| Exploit ScenarioDerived | A low-privileged authenticated AEM user (e.g., a content author) crafts a malicious URL or manipulates a web page containing a payload that is unsafely written into the DOM. When a victim with an active AEM session visits that crafted URL or interacts with the manipulated page, attacker-controlled JavaScript executes in the victim's browser within the AEM origin, enabling limited session/data theft or actions on the victim's behalf. No public exploit code has been identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated user to place script that executes in a victim's browser inside the AEM origin once that victim opens a crafted URL or interacts with a manipulated page. The flaw is client-side only, gated by two conditions - an authenticated low-privilege account on the AEM instance plus victim user interaction - and yields Low confidentiality and integrity impact with no availability effect, which is why the assessed real-world risk profile is genuinely low despite the network attack vector. No public exploit code has been identified at time of analysis, there is no confirmed active exploitation (not in CISA KEV), and EPSS is only 0.27% (18th percentile), indicating very little observed exploitation pressure. Affected deployments span AEM 6.5 LTS, AEM Cloud Service, and the general 6.5 line at 6.5.23 and earlier; Adobe documents the fix in security bulletin APSB25-115.
RemediationAI
Upgrade Adobe Experience Manager to the patched release specified in Adobe security bulletin APSB25-115 (https://helpx.adobe.com/security/products/experience-manager/apsb25-115.html), which covers the fix for 6.5.23 and earlier across the 6.5 LTS and AEM Cloud Service channels; the bulletin is the authoritative source for the exact fixed version for each deployment type, so confirm the target version there before applying. Because this is a DOM-based client-side flaw reachable only by an authenticated low-privileged user plus victim interaction, interim controls should focus on shrinking both gates: audit and remove unnecessary low-privilege AEM accounts and enforce least privilege on author/publish access, accepting that this restricts legitimate contributor workflows, and reduce the likelihood of a victim following a crafted link by applying a strict nonce- or hash-based Content-Security-Policy with script-src locked down to trusted origins, noting the trade-off that poorly written AEM components using inline scripts may break until refactored. Additional compensating measures include reviewing dispatcher and reverse-proxy rules to block suspicious parameter/fragment patterns (of limited value against DOM XSS because fragments are not sent to the server), and monitoring for anomalous script-injection attempts from authenticated accounts. There is no vendor-released patch information beyond the advisory, and no public exploit code has been identified at time of analysis, so no emergency workaround is required ahead of the documented upgrade.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a DOM-based cross-site scripting issue (CWE-79) in Adobe Experience Manager's client-side JavaScript, meaning attacker-controlled input reaches an unsafe browser sink - such as innerHTML, document.write, eval, or a similar DOM API - through the URL fragment, query parameters, or other client-side data sources, rather than being reflected or stored by the server. Because the vulnerable processing happens in the browser, the resulting script runs in the context of the AEM origin of the victim's session, which is why the CVSS vector records a scope change (S:C) even though confidentiality and integrity impacts are rated Low and availability is unaffected. The vector AV:N/AC:L/PR:L/UI:R indicates the attack is launched over the network but requires the attacker to hold a low-privileged authenticated account and requires the victim to interact with a crafted URL or manipulated page. CPE data identifies the affected products as adobe:experience_manager (generic 6.5 branch), adobe:experience_manager with the aem_cloud_service edition, and adobe:experience_manager 6.5 on the lts release channel - i.e. both on-premises 6.5 deployments and the managed AEM Cloud Service. Exploitation is confined to script execution in a victim's browser within the AEM origin; it is not server-side code execution or authentication bypass.
Know when Experience Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-reachable web app, but low-priv auth (PR:L) plus required victim interaction (UI:R) gate it; DOM-XSS crosses into browser context (S:C) with limited C:L/I:L and no availability impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim's browser. Exploitation of this issue requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)CVE.org
More in Experience Manager
View allSitecore Experience Manager, Platform, and Commerce versions 9.0 through 10.4 contain a Zip Slip vulnerability that allo
Sitecore PowerShell Extensions through version 7.0 allows authenticated users to upload arbitrary files including ASPX w
Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, wh
Adobe Experience Manager versions 6.5.23.0 and earlier contain a deserialization of untrusted data vulnerability that al
Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 through 10.4.1 contain a hardcoded administr
The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows r
Multiple Sitecore products allow remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remote
Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability. Rated critical severity (CVSS 9.8
Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerabilit
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), S
An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0
An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Comme
GitHub PoC
Exploit-DB