Adobe Experience Manager CVE-2025-64591

Exploitation requires an authenticated low-privileged account (PR:L) with the ability to inject content into AEM form fields, plus victim user interaction (UI:R) - a separate user must browse to the page containing the injected field for the stored script to execute. This is not remote-unauthenticated: it depends on the attacker already having form-authoring/editing access within AEM and on a victim viewing the affected page. Exposure is limited to AEM versions 6.5.23 and earlier, AEM 6.5 LTS, and AEM as a Cloud Service instances where the vulnerable form-field functionality is reachable by lower-privileged users; environments that tightly restrict authoring privileges reduce the realistic attack surface.

This is a moderate-severity stored XSS (CWE-79) in Adobe Experience Manager with a CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The signals are internally consistent and point to a real-but-not-urgent issue: the attack is network-reachable and low-complexity, but it requires an authenticated low-privileged account (PR:L) AND victim user interaction (UI:R), which materially constrains exploitability. The changed scope (S:C) and limited confidentiality/integrity impact (C:L/I:L, A:N) are typical of stored XSS, where injected script executes in another user's authenticated browser context. EPSS is low at 0.25% (15th percentile), the vulnerability is NOT on the CISA KEV list, and no public exploit code was identified - so exploitation status is 'no public exploit identified at time of analysis.' All exploitation signals agree that this is a genuine but low-priority vulnerability: real risk exists (authenticated insiders or compromised low-priv accounts could target other users/admins), but there is no evidence of widespread or active exploitation. No conflicting data was found between the CVSS vector and the description; both indicate authenticated injection with downstream execution on victim browsing. Prioritize via normal patch cycles rather than emergency response, with attention weighted by how exposed the affected authoring/form interfaces are.

A low-privileged user with access to author or edit form fields in Adobe Experience Manager injects malicious JavaScript into a vulnerable form field. When a higher-privileged victim (e.g., a content reviewer or administrator) later browses to the page containing that field, the stored script executes in their authenticated browser session, enabling session hijacking or actions on their behalf. No public proof-of-concept was identified, and successful exploitation depends on the victim actually viewing the affected page.