Adobe Experience Manager CVE-2025-64594

Exploitation requires the attacker to hold a low-privileged authenticated AEM account with the ability to write to the affected form fields (PR:L), and it requires a separate victim to subsequently browse the page containing the injected field (UI:R) - the payload does not fire on its own. Affected deployments are Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS. The dual requirement of valid authoring-level credentials plus victim interaction significantly limits realistic exploitation to environments where untrusted or many authors have form-editing access.

This is a genuinely moderate-priority issue rather than a top-tier emergency, and the multiple signals are consistent with that. The CVSS 3.1 base score is 5.4 (Medium), and the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N shows a network-reachable, low-complexity flaw that nonetheless requires BOTH low-level authentication (PR:L) AND victim user interaction (UI:R) - two meaningful barriers to mass exploitation. The scope change (S:C) correctly reflects that injected script executes in a victim's browser context (a different security authority than the AEM server), but confidentiality and integrity impact are only Low and availability impact is None. EPSS reinforces the low-urgency read: 0.25% probability at the 15th percentile indicates exploitation is not expected to be widespread or automated. The vulnerability is NOT listed in CISA KEV and no public exploit code was identified in the provided data, so there is no evidence of active exploitation. No SSVC decision data was supplied in the input, so an SSVC-based priority cannot be stated. In short: all available signals (Medium CVSS, low EPSS, no KEV, no POC, dual preconditions of auth + user interaction) agree that this is a real-but-not-critical stored XSS to patch on a normal cycle, not a drop-everything issue.

A low-privileged authenticated user (e.g., a content author or form editor) injects malicious JavaScript into a vulnerable AEM form field. The payload is stored and later executed in the browser of any victim - such as an administrator or site visitor - who views the page containing that field, enabling session theft or actions in the victim's context. No public proof-of-concept was identified in the provided data.