Adobe Experience Manager CVE-2025-64580

Requires an authenticated low-privileged account (PR:L) in Adobe Experience Manager with the ability to submit or edit content in the vulnerable form fields, and requires victim user interaction (UI:R): a separate user must browse to the page containing the injected field for the stored JavaScript to execute. Limiting factors: the attacker cannot act fully unauthenticated, the payload only fires against users who view the affected page (favoring higher-privileged victims such as reviewers/administrators), and impact is confined to the victim's browser session (C:L/I:L/A:N), not direct server compromise. Affected deployments include AEM 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service per the published CPEs.

This is a moderate-severity stored XSS (CVSS 5.4, CWE-79) with multiple signals pointing to limited real-world urgency rather than a top priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) shows network reachability and low complexity, but exploitation is gated by two meaningful requirements: the attacker needs low-privileged authenticated access (PR:L) to inject into form fields, and a victim must interact by browsing to the affected page (UI:R). The scope change (S:C) reflects that injected script executes in the victim's browser context rather than the vulnerable component itself, which is why confidentiality and integrity impact are only Low and availability is None. Exploitation signals are weak: EPSS is 0.25% (15th percentile), there is no CISA KEV listing and no public exploit identified, so there is no evidence of active exploitation or widespread automation. The signals are broadly consistent - low EPSS, no KEV, no POC, and a partial-impact CVSS all align - so this reads as a genuine but lower-tier issue appropriate for routine patch cycles, with priority raised only in environments where many lower-privileged content authors share AEM instances with privileged reviewers/administrators.

A low-privileged AEM content author or form editor injects malicious JavaScript into a vulnerable form field, which is stored by the application. When a higher-privileged user (e.g., an administrator or reviewer) later browses to the page containing that field, the script executes in their browser, enabling session/cookie theft or actions performed as the victim. No public exploit code has been identified, so an attacker would need to craft the payload themselves.