Adobe Experience Manager CVE-2025-64578

Exploitation requires the attacker to hold a low-privileged authenticated account in Adobe Experience Manager with the ability to submit or edit content in a vulnerable form field (PR:L), and it requires a victim to subsequently browse to the page that renders the stored field (UI:R) - the payload does not fire automatically. Impact is limited (C:L/I:L/A:N) and confined to the victim's browser session via the scope-changed XSS context. Affected deployments are AEM 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service per the supplied CPEs; patched versions are not vulnerable. Limiting factors: mandatory authentication, mandatory victim interaction, and no direct availability or full confidentiality/integrity compromise of the server.

This is a genuine but moderate-priority issue rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) describes a network-reachable but authentication-gated and user-interaction-dependent stored XSS: the attacker must already hold a low-privilege account (PR:L) and a victim must browse to the affected page (UI:R). The scope change (S:C) correctly reflects that injected script executes in the victim's browser security context rather than the application's. Corroborating exploitation signals point to LOW real-world urgency: EPSS is only 0.25% (15th percentile), the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced - so exploitation status is 'no public exploit identified at time of analysis.' All signals are internally consistent: a low-privilege, interaction-dependent, limited-impact (C:L/I:L/A:N) stored XSS with low exploitation probability. No conflicts between CVSS and the description were observed. The main caveat is that the only reference is the Adobe vendor advisory (APSB25-115); affected-version detail and the fix are vendor-stated, and there is no independent exploitation telemetry.

A low-privileged authenticated user (e.g., a content author or form editor in AEM) injects malicious JavaScript into a vulnerable form field that is persisted server-side. When a higher-value victim such as an administrator or another user later browses to the page rendering that field, the stored script executes in their browser, enabling session/cookie theft or actions performed as the victim. No public exploit code is referenced, and the attack depends on the victim actually viewing the affected page (UI:R).