Adobe Experience Manager CVE-2025-64600

Exploitation requires (1) a low-privileged authenticated account in Adobe Experience Manager with the ability to write to one of the affected form fields (PR:L - this is NOT remote-unauthenticated), and (2) a victim subsequently browsing to the page that renders the injected field (UI:R). The stored nature means the payload persists server-side and fires on normal page viewing. Limiting factors: an attacker must already possess authoring/contribution privileges, and impact is confined to the victim's browser session (C:L/I:L, no availability impact). Affected deployments are AEM 6.5.23 and earlier, AEM 6.5 LTS, and AEM as a Cloud Service per the supplied CPEs.

This is a moderate-severity stored XSS (CVSS 5.4) that should be treated as a routine, scheduled-patch priority rather than an emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) signals network reach and low complexity but two meaningful constraints: an attacker must already hold low-level authenticated access (PR:L) and a victim must interact by browsing to the affected page (UI:R). The scope change (S:C) and C:L/I:L reflect classic stored-XSS impact - script execution in a victim's browser context rather than direct server compromise, with no availability impact (A:N). Corroborating signals all point low: EPSS is 0.20% (10th percentile), the vulnerability is NOT listed in CISA KEV, and no public POC is referenced in the provided data. No SSVC decision data was supplied. Signals are internally consistent - there is no CVSS-vs-description conflict here - so the honest read is a legitimate-but-low real-world risk: a privileged-insider or compromised-low-tier-account vector against an enterprise CMS, not a mass-exploitation threat.

A low-privileged authenticated AEM author or form contributor injects malicious JavaScript into a vulnerable form field, which is stored by the application. When a victim (e.g., another author or an end user) later browses to the page rendering that field, the script executes in their browser, enabling session/cookie theft or actions in their authenticated context. No public exploit code is referenced, and exploitation requires both prior authenticated access and victim interaction.