Adobe Experience Manager CVE-2025-64576

Exploitation requires an authenticated low-privileged AEM account with the ability to write to a vulnerable form field (PR:L), making this an insider-or-compromised-credential vector rather than fully anonymous. It is a STORED XSS, so the attacker must have access to a form/content field that persists input. Execution is gated by victim user interaction (UI:R): the malicious script only fires when a separate victim navigates to the page rendering the tainted field. Affected deployments are AEM 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service per the CPE data. These limiting factors - required authentication, required victim browsing, and only Low confidentiality/integrity impact - meaningfully reduce real-world risk below the network-exploitable appearance of AV:N.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score of 5.4 (Medium) reflects the real constraints encoded in the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N: although the attack vector is network-based with low complexity, exploitation requires an authenticated low-privileged account (PR:L) AND victim user interaction (UI:R), with only Low confidentiality and integrity impact and no availability impact. The changed scope (S:C) correctly captures that injected script executes in a separate victim's browser context. The exploitation signals are consistent and point to low urgency: EPSS is only 0.25% (15th percentile), the CVE is NOT on CISA KEV, and no public exploit code was identified in the provided data. There is no conflict between signals here - a low EPSS, absence of KEV listing, and no POC all reinforce that widespread or active exploitation is not currently indicated. The main residual risk is the product's broad enterprise footprint and the fact that stored XSS in a CMS form field can be persistent and reach multiple downstream page visitors once planted.

A low-privileged authenticated user (e.g., a content author or form editor) injects malicious JavaScript into a vulnerable Adobe Experience Manager form field, where it is stored persistently. When another user - potentially a higher-privileged administrator or site visitor - later browses to the page containing that field, the script executes in their browser session. No public exploit code was identified at time of analysis, so this scenario is inferred from the description and CVSS vector rather than a demonstrated PoC.