Adobe Experience Manager CVE-2025-64592

Exploitation requires an authenticated account with at least low privileges in Adobe Experience Manager (PR:L) capable of writing to form fields that store user-supplied content, plus victim interaction: a target user must subsequently browse to the page rendering the injected field (UI:R). Affected deployments are AEM 6.5.23 and earlier, including AEM 6.5 LTS and AEM as a Cloud Service per the CPE data. Limiting factors that reduce real-world risk: the attacker cannot be fully unauthenticated, the payload only fires when a victim views the stored content, and impact is confined to in-browser script execution (Confidentiality/Integrity Low, no Availability impact).

This is a moderate-severity stored XSS (CVSS 5.4, CWE-79) that signals should be read as genuinely low-priority for most defenders. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) shows network reach and low complexity but requires an authenticated low-privileged account (PR:L) AND victim interaction (UI:R), which materially constrains exploitation. The scope change (S:C) reflects that injected script executes in a victim's browser context rather than only the AEM instance, but confidentiality and integrity impact are only Low and availability is None. Supporting signals agree with a low real-world priority: EPSS is 0.25% (15th percentile), there is no CISA KEV listing, and no public exploit code was identified. There is no conflict between the signals - a comparatively modest CVSS, low EPSS, absence of KEV, and no POC all point the same direction: a real but not urgent issue best handled in normal patch cadence. No contradictions between the vector and the description were found; the description's 'low privileged attacker' is consistent with PR:L, and 'executed when a victim browses' is consistent with UI:R.

A low-privileged authenticated user (e.g., a content author or form editor) injects malicious JavaScript into a vulnerable AEM form field. The payload is stored and later executes in the browser of any victim - such as an administrator or another user - who navigates to the page containing that field, enabling session theft or actions in the victim's context. No public exploit code was identified at time of analysis, and successful attack depends on victim interaction (viewing the page).