Adobe Experience Manager CVE-2025-64586

Exploitation requires an authenticated account with at least low privileges in Adobe Experience Manager (PR:L) capable of writing to the affected form fields, so this is not remotely reachable by anonymous users. It further requires victim interaction (UI:R): a user must browse to the page rendering the stored malicious field for the JavaScript to execute. Affected deployments are AEM 6.5.23 and earlier, including the 6.5 LTS line and AEM Cloud Service per the listed CPEs. Limiting factors: the dual requirement of a provisioned low-privilege author account plus a victim visiting the poisoned page substantially narrows practical exploitation to environments where untrusted or semi-trusted users can author form content.

This is a medium-severity stored XSS (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) that signals are consistent in rating as a lower real-world priority rather than an urgent threat. The vector shows network reachability and low attack complexity, but exploitation requires a low-privileged authenticated account (PR:L) AND victim user interaction (UI:R), both of which meaningfully constrain real-world abuse. EPSS reinforces this: 0.25% probability at the 15th percentile indicates low near-term exploitation likelihood. There is no CISA KEV listing and no public exploit code identified in the provided data, so there is no evidence of active exploitation. The scope change (S:C) and only Low confidentiality/integrity impact (no availability impact) reflect the typical blast radius of stored XSS - session/UI compromise in a victim's browser rather than direct server takeover. Net: a legitimate issue worth patching in normal cycles, not a high-real-risk emergency, with no conflicting signals present in the data.

A low-privileged authenticated user (e.g., a content or form author in AEM) injects malicious JavaScript into a vulnerable form field, which is stored persistently. When a victim - such as another author or an end user - browses to the page rendering that field, the script executes in their browser session, enabling actions like session/cookie theft or UI manipulation in the AEM context. No public proof-of-concept exploit was identified in the provided data.