Adobe Experience Manager CVE-2025-64569

Two concrete limiting conditions both apply: (1) the attacker must hold a low-privileged authenticated account on the AEM instance (CVSS PR:L), and (2) a victim must perform user interaction - per the description, 'visiting a crafted URL or interacting with a manipulated web page' (UI:R). This is a DOM-based (client-side) XSS, so the malicious payload is processed in the victim's browser rather than reflected/stored server-side. Affected deployments include AEM 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service per the CPE strings. Realistic risk is reduced because exploitation chains an authenticated attacker with social-engineering of a victim; it is not exploitable against anonymous visitors or default configurations without a valid account.

This is a moderate-severity, low-priority issue rather than an urgent threat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) describes a network-reachable but constrained flaw: it requires an already-authenticated low-privileged account (PR:L) AND victim user interaction (UI:R), which together substantially raise the bar versus a drive-by unauthenticated bug. The scope change (S:C) reflects that script executes in the victim's browser context rather than the AEM server, with only partial confidentiality and integrity impact (C:L/I:L) and no availability impact. Exploitation signals are weak and consistent with each other: EPSS is 0.27% (18th percentile), the CVE is NOT in CISA KEV, and no public POC is referenced - exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data in the input. All signals align (low EPSS, no KEV, no POC, constrained vector), so there is no conflict to flag; this is a genuine but low-urgency DOM XSS that should be patched on a normal cycle, not treated as an emergency.

A low-privileged authenticated user crafts a malicious URL or manipulated page that, when opened by a higher-value victim (e.g., an AEM author or administrator), triggers client-side DOM manipulation causing attacker-controlled script to run in the victim's browser session. The script could hijack the victim's AEM session, perform actions as the victim, or harvest page data. No public exploit code is identified at time of analysis, and success depends on convincing the victim to interact with the crafted content.