Adobe Experience Manager CVE-2025-64560

Exploitation requires (1) a low-privileged authenticated account on the target Adobe Experience Manager instance (CVSS PR:L - this is NOT an unauthenticated flaw), and (2) victim user interaction, specifically the victim visiting an attacker-crafted URL or interacting with a manipulated web page (UI:R) that triggers the DOM-based script execution. The injected script runs only in the victim's browser within the AEM origin (scope change, S:C). These two combined prerequisites - valid credentials plus social-engineering of a victim to click or interact - are the primary factors limiting realistic exploitation; there is no impact on availability and no server-side code execution. Affected deployments include AEM 6.5.23 and earlier, AEM 6.5 LTS, and AEM as a Cloud Service per the provided CPEs.

This is a moderate-severity, low-priority issue rather than an urgent threat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) describes a network-reachable DOM-based XSS that nonetheless requires BOTH low-level authenticated privileges (PR:L) AND victim user interaction (UI:R), which materially limits automatable, large-scale exploitation. The EPSS score of 0.25% (15th percentile) is low and consistent with the absence of any public exploit code and the lack of CISA KEV listing - there is no public exploit identified at time of analysis and no evidence of active exploitation. No SSVC decision data was provided in the input, so exploitation-status/automatable/technical-impact cannot be cross-referenced from that framework. All signals align downward: the only elevating factor is the scope change (S:C), reflecting that injected script executes in the victim's browser context outside the vulnerable component, but impact is bounded to Low confidentiality and Low integrity with no availability effect. Net: a legitimate issue to patch on a normal cycle, not an emergency.

A low-privileged authenticated AEM user (e.g., a content author or a user with limited CMS access) crafts a malicious URL or manipulated page that injects script into a vulnerable DOM sink. When a victim - typically a higher-privileged administrator or another user - visits the crafted URL or interacts with the manipulated page, the script executes in their browser session within the AEM origin. No public proof-of-concept exploit has been identified at time of analysis, and the requirement for both authentication and user interaction raises the practical bar.