Adobe Experience Manager CVE-2025-64616

Exploitation requires an authenticated low-privileged AEM account (PR:L) with the ability to write into form fields that are persistently stored and later rendered - i.e., content-authoring or form-editing capability within Adobe Experience Manager 6.5.23 or earlier (including AEM 6.5 LTS and AEM as a Cloud Service per the CPE list). The payload only triggers when a victim subsequently browses the page containing the injected field (UI:R), so a victim visit is a hard prerequisite. Limiting factors: the attacker cannot be fully anonymous (requires valid authoring-tier credentials), impact is confined to the victim's browser session (no server-side code execution or availability loss), and success depends on a privileged or targeted user actually viewing the affected page.

This is a moderate-risk, not high-priority, vulnerability and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4 Medium) describes a network-reachable but authentication-gated stored XSS: PR:L means the attacker must already hold low-privileged (e.g., content-author) access, and UI:R means a victim must browse the affected page for the payload to fire. The scope change (S:C) and dual low confidentiality/integrity impact reflect script execution in the victim's browser context rather than server compromise - there is no availability impact (A:N). The EPSS score of 0.25% (15th percentile) is low and aligns with this picture: no public exploit code is referenced, the CVE is NOT on the CISA KEV list, and there is no evidence of active exploitation. There is no SSVC decision data in the input to cross-reference. Net assessment: a legitimate issue to patch in routine cycles, but neither a widespread-exploitation emergency nor a high-CVSS-but-illusory risk - the authentication and user-interaction prerequisites, combined with limited (browser-side, Low) impact, keep real-world priority modest. No contradictions between the CVSS vector and the description were observed.

A low-privileged author or form-building user in Adobe Experience Manager injects malicious JavaScript into a vulnerable form field that is persistently stored. Later, when a higher-privileged user or site visitor browses the page rendering that field, the script executes in their browser, enabling session/cookie theft or UI redress in their authenticated context. No public exploit code is identified at time of analysis, and exploitation requires that authenticated attacker access plus victim interaction.