Adobe Experience Manager CVE-2025-64583

Exploitation requires an authenticated low-privileged attacker (CVSS PR:L) on an affected Adobe Experience Manager instance (version 6.5.23 or earlier, including the AEM 6.5 LTS and listed Cloud Service / on-prem configurations), plus victim user interaction (UI:R) - the victim must visit an attacker-crafted URL or interact with a manipulated web page for the DOM-based script to execute in their browser. These two factors - the need for a valid low-privilege account and the reliance on a victim actively following a crafted link - are the primary limiting factors and substantially reduce realistic risk versus an unauthenticated, no-interaction flaw. No non-default configuration prerequisite is stated in the description.

This is a moderate-severity, low-priority issue rather than an urgent threat. The CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) reflects a DOM-based XSS requiring both low-level authentication (PR:L) and user interaction (UI:R), with only Low confidentiality and integrity impact and no availability impact - the scope change (S:C) accounts for script execution crossing into the victim's browser context. Corroborating signals all point low: EPSS is 0.25% (15th percentile), indicating very low near-term exploitation probability, and the CVE is NOT in CISA KEV with no public POC identified, so there is no evidence of active exploitation or weaponization. The signals are internally consistent - no conflict between the CVSS network vector and the description, which confirms remote delivery via a crafted URL or manipulated page. No SSVC decision data was supplied in the input. Net: a legitimate flaw worth patching in a maintenance cycle, but not a drop-everything priority; the authentication plus user-interaction requirements meaningfully constrain real-world exploitability.

A low-privileged authenticated user (e.g. a content author) crafts a malicious URL or manipulated page that, when visited by a higher-value victim such as an AEM administrator, triggers DOM-based execution of attacker-controlled JavaScript in the victim's browser session. This could be used to hijack the victim's AEM session or perform actions in their context. No public exploit code was identified at time of analysis, and the attack depends on the victim interacting with the crafted content.