Adobe Experience Manager CVE-2025-64565

Exploitation requires a low-privileged authenticated account on the target Adobe Experience Manager instance (CVSS PR:L) AND victim user interaction (UI:R) - specifically the victim visiting an attacker-crafted URL or interacting with a manipulated web page, per the description. Affected deployments are AEM 6.5.23 and earlier (including AEM 6.5 LTS and, per the CPE list, AEM Cloud Service builds). Limiting factors that reduce realistic risk: the attacker cannot act purely remotely-unauthenticated (an account is needed), the victim must take an action, and impact is confined to limited confidentiality/integrity in the browser context with no availability impact. These constraints make opportunistic mass exploitation unlikely and favor targeted social-engineering-style delivery.

This is a moderate-severity (CVSS 5.4), low-priority issue by most signals. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates network-reachable but constrained exploitation: it requires a low-privileged authenticated account (PR:L) and victim user interaction (UI:R), with only limited confidentiality and integrity impact and no availability impact - consistent with a DOM-based XSS. EPSS corroborates low real-world risk at 0.25% (15th percentile), and there is no CISA KEV listing and no public exploit identified at time of analysis. No SSVC decision data was provided in the input. Signals are internally consistent - there is no conflict between the CVSS vector and the description (both agree exploitation needs a low-privileged actor plus user interaction). The scope change (S:C) is the one factor that elevates this slightly above a trivial self-XSS, reflecting script execution in the victim's browser context rather than the vulnerable component. Overall this is a genuine but non-urgent flaw that should be patched on a normal cycle rather than treated as an emergency.

A low-privileged authenticated AEM user crafts a malicious URL (or manipulated page) that injects attacker-controlled script into the DOM. When a victim (e.g., a content author or administrator) visits the crafted URL or interacts with the manipulated page, the script executes in their browser session within the AEM origin, potentially stealing session context or performing actions as the victim. No public exploit code was identified at time of analysis.