Adobe Experience Manager CVE-2025-64553

Requires an authenticated low-privileged AEM account (PR:L) with access to author/edit the vulnerable form fields, plus victim user interaction (UI:R) - a second user must browse to the page containing the injected field for the payload to fire. Impact is limited to script execution in the victim's browser within the AEM origin (C:L/I:L, no availability impact). Applies to AEM 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS per the CPE data. The dual requirement of prior authentication and victim interaction meaningfully limits real-world exploitability against hardened, access-controlled AEM author environments.

This is a high-CVSS-context-but-low-real-risk issue. The CVSS 3.1 base score is only 5.4 (Medium), and every signal reinforces low practical urgency: EPSS is 0.20% (9th percentile), there is no CISA KEV listing, and no public exploit code has been identified. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) shows the attack is double-gated - it requires an authenticated low-privileged account (PR:L) AND victim user interaction (UI:R) - with only low confidentiality and integrity impact and no availability impact. The scope change (S:C) reflects that injected script executes in the victim's browser origin rather than only the vulnerable component, which is standard for stored XSS. No signals conflict: low EPSS, no KEV, and no POC all agree with the modest base score. This is a routine hardening/patch-cycle item, not an emergency. The sole reference is the Adobe advisory APSB25-115; no independent EPSS-elevating or exploitation evidence exists.

A low-privileged authenticated AEM author account injects malicious JavaScript into a vulnerable form field. The payload is stored, and when another user (e.g., an author, reviewer, or admin) later browses to the page containing that field, the script executes in their browser session, enabling session/context theft within the AEM origin. No public POC has been identified at time of analysis.