Adobe Experience Manager CVE-2025-64604

Exploitation requires an authenticated low-privileged AEM account (PR:L) with the ability to submit or edit content in a vulnerable form field, and it further requires a victim to subsequently browse to the page rendering that field (UI:R) - both conditions must be met, which substantially limits opportunistic or unauthenticated attacks. The affected feature is script-injectable form fields in Adobe Experience Manager 6.5.23 and earlier (including 6.5 LTS and AEM Cloud Service). The flaw is not reachable by anonymous/unauthenticated users and cannot self-propagate without victim page visits, so impact is highest in multi-author or externally-accessible authoring environments where low-privileged accounts are broadly provisioned.

This is a moderate-severity stored XSS (CVSS 5.4, CWE-79) that the combined signals rate as a low operational priority rather than an urgent threat. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) shows network reachability and low complexity but requires an authenticated low-privileged account (PR:L) AND victim interaction (UI:R), both of which constrain real-world exploitation; the scope change (S:C) and C:L/I:L reflect that injected script executes in another user's browser context rather than compromising the server. EPSS reinforces low urgency at 0.25% (15th percentile), and the vulnerability is NOT listed in CISA KEV, with no public exploit code identified - so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied in the input, so automatable/technical-impact cannot be independently cited. Signals are consistent (moderate CVSS, low EPSS, no KEV/POC), pointing to a genuine but non-critical issue best handled in normal patch cycles; the main caveat is that stored XSS in a widely deployed CMS can enable session/credential theft or admin-targeted phishing if a low-privileged author account is obtained.

A low-privileged authenticated user (e.g., a content author) injects malicious JavaScript into a vulnerable AEM form field, which is stored persistently. When a victim - potentially a higher-privileged administrator or another visitor - browses to the page rendering that field, the script executes in their browser, enabling session hijacking or actions on their behalf. No public exploit code was identified, and exploitation depends on both the attacker's authenticated access and the victim visiting the affected page.