Adobe Experience Manager CVE-2025-64622

Exploitation requires an authenticated low-privileged AEM account with the ability to write to a vulnerable form field (per PR:L), and it requires a victim to subsequently browse to the page that renders the injected field (per UI:R) - the payload does not execute without a viewer. Affected deployments are Adobe Experience Manager 6.5.23 and earlier (including 6.5 LTS) and the AEM Cloud Service builds covered by the CPE list. Limiting factors that reduce real-world risk: the attacker cannot be fully anonymous (needs valid low-privilege credentials), exploitation is gated on victim interaction, and stored payload delivery depends on the victim visiting the specific content/page containing the tainted field. No special non-default configuration is called out in the description.

This is a genuine-but-moderate-priority issue rather than a top-tier emergency, and the available signals are consistent with each other. The CVSS 3.1 base score of 5.4 (Medium) reflects a network-accessible (AV:N) stored XSS with low attack complexity (AC:L) that nonetheless requires the attacker to already hold low privileges (PR:L) and requires victim interaction (UI:R) - i.e., the victim must browse to the page hosting the injected field. Impact is limited to Low confidentiality and Low integrity with a scope change (S:C, reflecting script execution in the victim's browser security context) and no availability impact. The EPSS score of 0.20% (10th percentile) is low and aligns with a non-wormable, interaction-dependent, authenticated flaw - there is no signal of mass exploitation. The CVE is NOT listed in CISA KEV and no public exploit code was identified in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No signals conflict here: the authenticated, interaction-gated nature of the bug and the low EPSS mutually reinforce a 'patch in normal cycle, prioritize if AEM authoring is exposed to many low-trust users' posture rather than drop-everything urgency.

A low-privileged AEM author (or any user permitted to populate form fields) injects malicious JavaScript into a vulnerable form field, which is stored by Experience Manager. When a higher-privileged user or site visitor later browses to the page rendering that field, the script executes in their browser session, enabling session/cookie theft, CSRF-style actions, or UI redressing in the victim's context. No public proof-of-concept was identified in the provided data; exploitation requires the attacker to first authenticate and the victim to view the affected page (AV:N but UI:R).