Adobe Experience Manager CVE-2025-64563

Exploitation requires (1) a low-privileged authenticated AEM account to craft/inject the malicious input (CVSS PR:L), and (2) victim user interaction - specifically the victim visiting a crafted URL or interacting with a manipulated web page (CVSS UI:R, per the description). The impact is limited to script execution in the victim's browser context (C:L/I:L, no availability impact). These two prerequisites - valid authentication plus a human victim being socially engineered into interaction - are the primary limiting factors and make opportunistic or automated mass exploitation impractical; the affected scope is AEM 6.5.23 and earlier, AEM 6.5 LTS, and AEM as a Cloud Service per the provided CPEs.

This is a genuinely moderate, not high-priority, issue and the signals are internally consistent. The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) describes a network-reachable but constrained flaw: it requires an already-authenticated low-privileged account (PR:L) AND victim user interaction (UI:R), which together substantially raise the bar versus a drive-by remote flaw. The scope change (S:C) and dual low confidentiality/integrity impact reflect typical XSS behavior where script executes in the victim's browser context rather than the application process. The EPSS score of 0.20% (9th percentile) is low and aligns with the lack of other exploitation signals - this CVE is NOT in CISA KEV and there is no public exploit identified at time of analysis. There is no conflict between signals here: low CVSS, low EPSS, no KEV, and no POC all point the same direction. The main caveat is that DOM-based XSS requiring both authentication and user interaction is usually exploited in targeted social-engineering scenarios rather than mass automation, so treat this as a patch-in-normal-cycle item rather than an emergency, unless the affected AEM instance is internet-facing with many low-privileged authors.

A low-privileged authenticated user (e.g. a limited AEM author account) crafts a malicious URL or manipulated page that triggers the DOM-based XSS sink, then lures a higher-privileged victim into visiting it. When the victim's browser processes the crafted input, attacker-controlled script executes in the victim's AEM session context, potentially allowing session abuse or actions on behalf of the victim. No public exploit code is identified at time of analysis, and successful exploitation depends on the victim actually interacting with the crafted content.