Adobe Experience Manager CVE-2025-64554

Exploitation requires a low-privileged but authenticated AEM account with the ability to write to the vulnerable form fields (PR:L - e.g., an author/content-contributor role), and it requires victim user interaction (UI:R): a second user must subsequently browse to the page rendering the stored payload. It affects AEM 6.5.23 and earlier, including AEM Cloud Service and AEM 6.5 LTS. This is not a default-config unauthenticated flaw - the need for a valid authoring account plus a victim page visit substantially limits realistic impact to insider or compromised-author scenarios, with impact confined to client-side script execution (no server-side code execution or availability impact).

This is a genuine but low-priority issue despite the network attack vector. Signals align consistently toward low real-world urgency: EPSS is 0.25% (15th percentile), there is no CISA KEV listing (not actively exploited), and no public POC has been identified. The CVSS 5.4 (Medium) is honest and self-limiting - although AV:N and AC:L, exploitation is double-gated by PR:L (attacker must already hold a low-privileged authenticated AEM account, typically an author/content contributor) and UI:R (a victim must browse to the page hosting the injected script). The scope change (S:C) and reflected impacts are only C:L/I:L with A:N, consistent with client-side script execution in a victim browser rather than server compromise. This is a high-CVSS-but-low-real-risk profile relative to the unauthenticated 9.3 DOM-XSS members of the same Adobe batch; it is a defense-in-depth patch, not an emergency. No conflicting signals across sources - all point to Medium/Low.

A low-privileged authenticated AEM author injects a malicious JavaScript payload into a vulnerable form field. The payload is stored server-side; when a victim (e.g., another author or an administrator) later browses to the page containing that field, the script executes in their browser session in the AEM origin, enabling session/cookie theft or actions on their behalf. No public exploit code has been identified at time of analysis.