Adobe Experience Manager CVE-2025-64562

Exploitation requires an authenticated attacker holding a low-privilege AEM account (PR:L) and requires victim user interaction (UI:R) - specifically, the victim visiting an attacker-crafted URL or interacting with a manipulated web page that triggers the DOM-based script injection. Limiting factors: the need for valid low-privilege credentials narrows the attacker pool to insiders or compromised accounts, and the dependence on victim interaction means it cannot be exploited silently or at scale. Affected deployments are AEM 6.5.23 and earlier (including 6.5 LTS) and AEM as a Cloud Service per the CPE data; environments already patched to a later 6.5.x build are not affected.

This is a moderate, not top-priority, issue whose signals are consistent and point to limited real-world urgency. The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) reflects a network-reachable but authenticated (PR:L) flaw that additionally requires victim user interaction (UI:R), with only Low confidentiality and integrity impact and a scope change (S:C) typical of XSS executing in another security context (the victim's browser). EPSS reinforces low urgency: 0.25% exploitation probability at the 15th percentile indicates it is among the less-likely-to-be-exploited CVEs. There is no CISA KEV listing and no public proof-of-concept referenced, so exploitation status is 'no public exploit identified at time of analysis.' The signals do not conflict - low EPSS, no KEV, no POC, and a moderate CVSS all agree this is a real but low-to-moderate priority issue rather than an emergency. The main caveat is that DOM-based XSS requiring low privileges plus user interaction is more useful in targeted phishing/social-engineering chains than in mass automated exploitation.

A low-privileged authenticated AEM user crafts a URL or manipulated page that injects malicious script which is reflected into the DOM and executed in a victim's browser when they visit the link or interact with the page. Because exploitation requires both attacker authentication and victim interaction (UI:R), a realistic path is an insider or compromised low-privilege account luring a higher-privileged author/administrator into the crafted URL to run script in their session. No public exploit code is referenced at the time of analysis.