Adobe Experience Manager CVE-2025-64627

Exploitation requires an authenticated low-privileged AEM account with the ability to write to vulnerable form fields (PR:L), and a second victim user must subsequently navigate to the page rendering that stored field (UI:R) for the payload to fire. It applies to Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and the 6.5 LTS line per the CPE list. Limiting factors: the attacker cannot be fully anonymous (needs a valid low-priv authoring session), user interaction (page visit) is mandatory, and impact is confined to client-side script execution (C:L/I:L, no availability impact). These constraints substantially reduce real-world risk below what the network attack vector alone would suggest.

All signals point to a genuinely LOW-priority issue despite the MEDIUM 5.4 CVSS. The vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) is doubly gated: it requires PR:L (an authenticated low-privileged account with content-authoring access to AEM) AND UI:R (a victim must browse to the page hosting the injected field). This is a stored XSS with only C:L/I:L impact (script execution in a victim browser, no direct data destruction or availability loss). EPSS reinforces this: 0.25% probability at the 15th percentile - very low expected exploitation. There is no CISA KEV listing and no public exploit code, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. Signals are consistent, not conflicting: low EPSS, no KEV, no POC, and impact-limiting CVSS metrics all agree this is a real-but-low-urgency defensive fix rather than an emergency. The realistic threat is an insider or a compromised low-priv authoring account escalating within the CMS or targeting other authenticated users/admins - a plausible but constrained scenario in enterprise AEM deployments.

A low-privileged authenticated AEM user (e.g., a content author) injects a malicious JavaScript payload into a vulnerable form field. When another user - potentially an administrator - later browses to the page containing that field, the stored script executes in their browser under the AEM origin, enabling session-token theft or actions on their behalf. No public proof-of-concept exploit has been identified.