Adobe Experience Manager CVE-2025-64597

Exploitation requires the attacker to hold a low-privileged authenticated AEM account (PR:L) with access to write content into vulnerable form fields, and requires a victim to subsequently browse the page rendering that injected field (UI:R) - the payload does not fire without a human viewing the affected page. It affects Adobe Experience Manager 6.5.23 and earlier, including the 6.5 LTS line and AEM Cloud Service per the supplied CPEs. Key limiting factors: no unauthenticated path (an account is needed), mandatory victim interaction, and impact bounded to the victim's browser context (Low C/I, no availability or direct server compromise). The exact vulnerable form field/component is not identified in the available data.

This is a genuinely moderate-risk issue that should not be prioritized as a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) describes a network-reachable but authentication-dependent and user-interaction-dependent stored XSS with only Low confidentiality and integrity impact and no availability impact - the Scope:Changed flag reflects that injected script executes in the victim's browser trust context rather than the server's. All exploitation signals point the same direction (low urgency), with no conflict: EPSS is 0.25% (15th percentile), indicating a low modeled probability of exploitation in the near term; there is no CISA KEV listing (not actively exploited per available data); and no public exploit code was identified. No SSVC decision data was provided in the input, so an SSVC-based priority cannot be stated. The combination of required authentication (PR:L), required victim interaction (UI:R), and limited CIA impact means this is a defense-in-depth hardening item rather than a drop-everything vulnerability, despite AEM's broad enterprise footprint.

A low-privileged authenticated AEM user (e.g. a content author or form editor) injects malicious JavaScript into a vulnerable form field, which is stored persistently. When a victim - such as another author or an administrator - later browses to the page rendering that field, the script executes in their browser session, enabling session/token theft or actions in their authenticated context. No public exploit code was identified at time of analysis, so exploitation would require an attacker to craft the payload independently.