Adobe Experience Manager CVE-2025-64582

Exploitation requires an authenticated, low-privileged account (PR:L) with the ability to write into the affected AEM form fields, and it is limited by required victim interaction (UI:R) - a separate user must browse to the page rendering the injected field before the stored script fires. It applies to Adobe Experience Manager 6.5.23 and earlier (including the 6.5 LTS and AEM Cloud Service CPEs listed); there is no indication a non-default configuration is needed, but the dependency on both attacker authentication and victim browsing meaningfully constrains real-world exploitation compared to an unauthenticated flaw.

This is a genuinely moderate, not high, priority. The CVSS 3.1 base score of 5.4 (vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) describes a network-reachable but user-interaction-dependent stored XSS that requires low-level authenticated privileges to plant the payload, with only Low confidentiality and integrity impact and no availability impact. The scope change (S:C) reflects that injected script executes in a victim's browser context rather than the AEM server itself, which is why impacts stay Low rather than High. Corroborating signals point to low real-world urgency: EPSS is 0.20% at the 9th percentile, indicating very low near-term exploitation probability, and there is no CISA KEV listing and no public exploit identified at time of analysis - so there is no evidence of active exploitation or weaponization. No SSVC decision data was provided in the input. The signals are mutually consistent (modest CVSS + low EPSS + no KEV/POC), so there is no conflict to flag; the main caveat is that stored XSS in an enterprise CMS can be leveraged against privileged admin/author users, which could amplify impact beyond the Low ratings if an administrator is the victim.

A low-privileged AEM author-tier user injects a malicious JavaScript payload into a vulnerable form field, which is stored by the application. When a higher-privileged user or site visitor later browses to the page rendering that field, the script executes in their browser, enabling session/cookie theft or actions performed as the victim. No public exploit code was identified at time of analysis, so exploitation would require an attacker to craft the payload independently.