Adobe Experience Manager CVE-2025-64564

Exploitation requires (1) a low-privileged authenticated account on the Adobe Experience Manager instance (PR:L - not anonymous/remote-unauthenticated), and (2) victim user interaction, specifically the victim visiting an attacker-crafted URL or interacting with a manipulated web page (UI:R), per the description. The vulnerability is DOM-based XSS (CWE-79), so the malicious payload is executed client-side in the victim's browser rather than reflected/stored server-side. Limiting factors that reduce realistic risk: the mandatory authentication foothold, the dependence on social-engineering the victim into clicking/interacting, and only Low confidentiality/integrity impact with no availability impact. This affects AEM 6.5.23 and earlier (including the 6.5 LTS line per the CPE); applicability to AEM as a Cloud Service should be confirmed against the Adobe advisory.

This is a genuine-but-moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N = 5.4 Medium) tells a consistent story: network-reachable and low-complexity, but it requires a low-privileged authenticated account (PR:L) AND victim user interaction (UI:R), with only Low confidentiality/integrity impact and no availability impact. The scope change (S:C) reflects that a DOM-based XSS executes in the victim's browser context, outside the vulnerable component's authorization boundary - the main reason the score is Medium rather than Low. Exploitation-probability signals reinforce a low urgency: EPSS is 0.25% (15th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' All signals are mutually consistent - there is no conflict between CVSS, EPSS, and KEV here. The dual prerequisites (authentication plus user interaction) meaningfully limit mass exploitation, making this more suited to targeted phishing/social-engineering against AEM authors/users than to opportunistic internet-wide attacks. Patch when convenient per normal cycles rather than as an out-of-band emergency.

A low-privileged authenticated AEM user crafts a malicious URL or manipulated page that injects script into the DOM; when a victim (e.g. an AEM author or admin) visits the crafted URL or interacts with the page, the script executes in their browser session. No public proof-of-concept was identified at time of analysis, and because AC is Low the trigger is technically simple once the victim interaction occurs. This enables session/token theft or actions in the victim's authenticated context.