Adobe Experience Manager CVE-2025-64575

Exploitation requires an authenticated low-privileged account (PR:L) with the ability to write into AEM form fields, plus a victim who subsequently browses to the page containing the injected field (UI:R) - the attacker cannot trigger execution alone. Limiting factors: the attacker must already hold valid AEM credentials with content/form-authoring rights, and a separate victim must view the malicious content for the stored payload to fire, so this is not remote-unauthenticated and not self-contained. Affected scope is Adobe Experience Manager 6.5.23 and earlier (including the 6.5 LTS and AEM Cloud Service CPE entries listed).

This is a genuine but moderate-priority issue, not a high-urgency emergency. The CVSS 3.1 score of 5.4 (Medium) is consistent across all available signals. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N shows network-reachable but authenticated (PR:L) exploitation that additionally requires victim interaction (UI:R), with only Low confidentiality and integrity impact and no availability impact - a classic stored XSS profile. EPSS reinforces low real-world urgency at 0.25% (15th percentile), and there is no CISA KEV listing and no public exploit identified, so there is no evidence of active or automated exploitation. No SSVC decision data was provided in the input. The signals are mutually consistent (medium CVSS + low EPSS + no KEV/POC), so there is no conflict to flag; the main caveat is that the dual requirement of attacker authentication AND victim interaction materially lowers practical risk below what a raw 'network vector' reading might suggest.

A low-privileged authenticated user (e.g., an author or content contributor) injects malicious JavaScript into a vulnerable AEM form field, which is stored server-side. When a victim - such as another author or administrator - later browses to the page rendering that field, the script executes in their browser, potentially stealing session tokens or performing actions in their authenticated context. No public exploit code is known to exist at time of analysis.