Adobe Experience Manager CVE-2025-64626

Requires an authenticated low-privileged AEM account (PR:L) with the ability to submit content into a vulnerable form field, PLUS victim user interaction (UI:R) - a separate user must browse to the page rendering the injected field for the script to execute. Affects Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and AEM 6.5 LTS. These two gates (authentication to inject + victim page visit) meaningfully limit exploitation despite the network vector; there is no unauthenticated or default-config remote path. Mitigation is applying the APSB25-115 update.

This is a genuine but LOW-priority issue despite the network attack vector. The CVSS 3.1 base score is 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - exploitation is double-gated: it requires an authenticated low-privileged account (PR:L) AND victim user interaction (UI:R, the victim must browse to the page containing the injected field). Impact is limited to C:L/I:L with no availability impact. EPSS reinforces low real-world risk at 0.25% (15th percentile), well below levels associated with active exploitation. Not in CISA KEV, and no public exploit code was identified. SSVC-style reading: exploitation status is 'none', not automatable (requires an authenticated injector plus a victim clicking through), and technical impact is 'partial'. All signals agree: this is a real-but-low-severity stored XSS, not a high-CVSS-but-inflated finding - the score itself is already modest. No conflicting signals; the CVSS vector, EPSS, and description are internally consistent.

A low-privileged authenticated AEM author account injects a malicious JavaScript payload into a vulnerable form field. The payload is stored, and when another user (e.g., an editor or admin) browses to the page rendering that field, the script executes in their browser session within the AEM origin, enabling session/cookie theft or actions on their behalf. No public POC was identified, and the scope-change (S:C) reflects script execution crossing into the victim's browser security context.