Adobe Experience Manager CVE-2025-64558

Exploitation requires the attacker to hold a low-privileged authenticated account on Adobe Experience Manager (PR:L) with the ability to write into a vulnerable form field, and it requires victim interaction (UI:R) - a separate user must browse to the page that renders the injected field before the stored JavaScript executes. It affects AEM 6.5.23 and earlier, including the 6.5 LTS and AEM as a Cloud Service variants per the CPE data. Limiting factors that reduce realistic risk: no anonymous/unauthenticated path (an account and injection capability are prerequisites), dependence on a victim visiting the specific page, and impact confined to the victim's browser session (C:L/I:L, no availability or direct server compromise). Highest exposure is in authoring/multi-tenant deployments where lower-trust content contributors can reach higher-privileged viewers.

This is a moderate-severity stored XSS (CVSS 5.4, CWE-79) whose real-world priority is low-to-moderate. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) signals network reach and low complexity but is gated by two meaningful barriers: the attacker must already hold low-level authenticated privileges (PR:L) and a victim must interact by browsing to the page containing the injected field (UI:R). The scope change (S:C) correctly reflects that injected script executes in the victim's browser context rather than the AEM server, and confidentiality/integrity impact is limited (C:L/I:L) with no availability impact. Exploitation signals are weak and mutually consistent: EPSS is only 0.25% (15th percentile), there is no CISA KEV listing, and no public exploit was identified - so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The signals do not conflict; a low EPSS alongside absent KEV/POC reinforces that this is a realistic-but-not-urgent issue, not a high-CVSS/low-real-risk mislabel nor an under-rated sleeper. Primary residual risk is in multi-tenant or authoring environments where a lower-trust author could target higher-privileged reviewers/administrators who view the form.

A low-privileged author or form editor on an Adobe Experience Manager instance (6.5.23 or earlier) injects malicious JavaScript into a vulnerable form field. When a higher-privileged user or site visitor later browses to the page rendering that field, the stored script executes in their browser, enabling session/cookie theft, CSRF-style actions, or UI redressing within the AEM context. No public exploit is known, and exploitation depends on the attacker already having authenticated low-privilege access plus a victim visiting the affected page.