Adobe Experience Manager CVE-2025-64566

Exploitation requires an authenticated low-privileged AEM account (PR:L) AND victim user interaction (UI:R) - specifically the victim visiting a crafted URL or interacting with a manipulated web page that injects attacker-controlled script into the DOM. The flaw affects Adobe Experience Manager 6.5.23 and earlier, the 6.5 LTS line, and AEM Cloud Service per the CPE data. Limiting factors that reduce realistic risk: the attacker cannot act fully unauthenticated, exploitation fails without the victim's click/interaction, impact is confined to the victim's browser session (Low confidentiality/integrity, no availability impact), and success depends on social-engineering a privileged victim rather than an automatable remote trigger.

This is a medium-severity (CVSS 5.4) DOM-based XSS with multiple signals pointing to limited real-world risk despite its network attack vector. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) shows network reach and low complexity, but it is tempered by two real barriers: the attacker needs low-level privileges (PR:L, i.e. authenticated) and the victim must perform user interaction (UI:R), such as visiting a crafted URL. The scope change (S:C) reflects that injected script executes in the victim's browser context, but confidentiality and integrity impact are only Low and availability impact is None, so this is not a system-compromising flaw on its own. The EPSS score of 0.27% (18th percentile) is low, indicating no meaningful signal of mass exploitation activity. There is no CISA KEV listing and no public exploit identified, so there is no active-exploitation or weaponization evidence. No SSVC decision data was provided in the input. Net assessment: this is a legitimate but non-urgent issue - a classic high-reach-but-low-real-impact XSS requiring both authentication and victim interaction - that should be patched in normal cycles rather than treated as an emergency. Signals are internally consistent (low EPSS, no KEV, no POC, moderate CVSS all align); no conflicting data was found.

An authenticated low-privileged user of Adobe Experience Manager crafts a URL or manipulated page that injects malicious JavaScript into the DOM, then lures a higher-value victim (e.g. an author or administrator) into clicking it. When the victim's browser processes the crafted input, the script executes in their authenticated AEM session, enabling session/action abuse within their browser context. No public proof-of-concept exploit was identified at the time of analysis.