Adobe Experience Manager CVE-2025-64555

Exploitation requires an authenticated low-privileged account on an Adobe Experience Manager instance (versions 6.5.23 and earlier, including AEM Cloud Service and 6.5 LTS) with the ability to submit content into the vulnerable form fields. The stored payload only triggers when a victim subsequently navigates to the page rendering that field (required user interaction, UI:R). Limiting factors: valid authentication is mandatory (PR:L, not unauthenticated), victim browsing is required to fire the script, and impact is confined to limited confidentiality/integrity in the victim's browser (C:L/I:L) with no server compromise or availability impact.

This is a genuine but low-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) describes a stored XSS that is doubly gated: the attacker must already hold low-privileged authenticated access (PR:L) to an AEM author instance to inject the payload, and a victim must then browse to the affected page (UI:R) for the script to fire. The scope change (S:C) reflects that injected script executes in the victim's browser origin rather than the CMS backend, but impacts are limited to C:L/I:L with no availability effect - this is not server-side code execution. EPSS reinforces the low-urgency read at 0.25% (15th percentile), and there is no CISA KEV listing and no public exploit code identified. No SSVC decision data was provided in the input. Signals are internally consistent - moderate CVSS, low EPSS, no exploitation evidence - so this is a high-CVSS-context-but-modest-real-risk item best handled through normal patch cadence rather than emergency response. No data conflicts were observed; the CVSS vector aligns with the description (authenticated injection, victim interaction).

A low-privileged authenticated AEM user (e.g., a content contributor or form author) injects malicious JavaScript into a vulnerable form field that is persistently stored. When another user - such as an administrator or site visitor - later browses to the page rendering that field, the script executes in their browser session, enabling session-token theft or actions in their authenticated context. No public exploit code has been identified at time of analysis.