Adobe Experience Manager CVE-2025-64579

Exploitation requires an authenticated low-privileged AEM account (PR:L) with the ability to write into form fields that are persisted and later rendered - this is the specific vulnerable surface named in the description. It further requires victim user interaction (UI:R): a separate user must browse to the page containing the stored malicious field for the payload to fire. These two prerequisites - valid authoring-level credentials plus a victim visiting the affected page - materially limit exploitation versus an unauthenticated drive-by, and impact is confined to confidentiality and integrity of the victim's browser session (A:N, no availability impact).

This is a genuinely moderate-priority issue, not an inflated high-severity one - all signals align toward low real-world urgency. The CVSS 3.1 base score is 5.4 (Medium), and its vector confirms meaningful friction: AV:N allows remote reach, but PR:L requires the attacker to already hold a low-privileged authenticated account, and UI:R means a victim must actively browse to the page hosting the injected payload. EPSS reinforces this: 0.25% probability at the 15th percentile indicates very low expected exploitation volume. There is no CISA KEV listing and no public exploit code identified in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The one signal worth noting is scope change (S:C) with C:L/I:L - consistent with stored XSS where injected script executes in another user's authenticated session, potentially an administrator, which is why the score lands above a trivial 4.x despite the authentication and interaction prerequisites. Net: a real but constrained vulnerability suited to routine patch-cycle remediation rather than emergency response.

A low-privileged authenticated AEM author submits a form field containing malicious JavaScript, which is stored persistently. When a higher-privileged user - such as a content reviewer or administrator - later browses to the page rendering that field, the script executes in their authenticated browser context, enabling session-context actions or data theft. No public proof-of-concept exploit was identified in the provided data.