Adobe Experience Manager CVE-2025-64556

Requires an authenticated low-privileged AEM account (PR:L) with the ability to submit data into the affected form fields, plus victim user interaction (UI:R) - a separate user must navigate to the page containing the injected field for the stored payload to fire. Exploitation is therefore limited by both the need for valid credentials on the AEM instance and the requirement that a victim view the malicious page. Impact is confined to client-side script execution in the victim's browser (C:L/I:L, no availability impact). Affects Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and the 6.5 LTS line.

This is a genuinely low-priority issue despite the network attack vector. The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) is doubly gated: it requires an authenticated low-privileged account (PR:L) AND victim user interaction (UI:R - a victim must browse to the page hosting the injected field). EPSS reinforces the low urgency at just 0.25% (15th percentile). There is no CISA KEV listing and no public exploit code identified. The impact is limited to C:L/I:L with A:N, consistent with client-side script execution rather than server compromise - the S:C scope change reflects that injected JavaScript executes in the victim's browser origin, not the AEM server. No signals conflict: CVSS, EPSS, and the absence of KEV/POC all point the same direction. This is a real-but-minor stored XSS, not a high-CVSS-low-real-risk mislabel and not an urgent priority. It should be patched on a normal cadence via APSB25-115 rather than emergency-escalated.

A low-privileged authenticated AEM user (e.g., an author or form editor) injects malicious JavaScript into a vulnerable form field. When a victim - such as an administrator or another user - later browses to the page containing that field, the stored script executes in their browser session, enabling session/cookie theft or actions in the victim's context. No public proof-of-concept exploit has been identified at time of analysis.