Adobe Experience Manager CVE-2025-64559

Exploitation requires an authenticated low-privileged account in Adobe Experience Manager with the ability to edit form fields (per PR:L), and it is stored/persistent XSS triggered only when a victim subsequently browses to the page containing the injected field (UI:R). Limiting factors: the attacker must already hold authoring/form-edit privileges, a separate victim must navigate to the affected content for the payload to fire, and impact is confined to the victim's browser session (Low C/I, no availability impact). This makes it most relevant in multi-user AEM authoring/collaboration deployments rather than against anonymous public visitors.

This is a moderate-severity stored XSS (CVSS 5.4) whose signals consistently point to a genuine but non-urgent issue. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) requires a low-privileged authenticated attacker and victim user interaction (browsing to the affected page), with only Low confidentiality and integrity impact and a changed scope reflecting script execution in the victim's browser context. EPSS is low at 0.20% (9th percentile), the CVE is NOT on CISA KEV, and no public exploit code was identified - all three low-urgency signals agree, so there is no evidence of active or imminent widespread exploitation. No SSVC decision data was supplied. The signals are mutually consistent (authenticated + user-interaction + low EPSS + no KEV/POC), so this is a real-but-low-priority finding rather than a high-CVSS/low-real-risk mismatch; prioritize behind unauthenticated or KEV-listed flaws but patch in normal cycles, especially for multi-author AEM authoring environments where a low-privileged content contributor could target higher-privileged reviewers.

A low-privileged AEM author or form editor injects malicious JavaScript into a vulnerable form field. When another user - such as a content reviewer or administrator - browses to the page containing that field, the script executes in their authenticated browser session, enabling session/token theft or actions on their behalf. No public exploit code was identified at time of analysis.