Adobe Experience Manager CVE-2025-64789

Exploitation requires a low-privileged authenticated account on the target AEM instance (PR:L) with the ability to submit or edit the vulnerable form field, and it requires a victim to subsequently browse to the page containing that field (UI:R) for the stored JavaScript to execute. Impact is confined to the victim's browser context (C:L/I:L, S:C - the injected script crosses into the victim's authenticated session). Limiting factors: attacker must already hold valid credentials, the payload only fires on victim page views, and there is no server-side code execution or availability impact. Affects AEM 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS.

This is a genuinely low-priority issue despite its network attack vector. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4 MEDIUM) shows exploitation is doubly gated: it requires low-privilege authenticated access (PR:L) to inject the payload AND victim user interaction (UI:R) to trigger it. Impact is limited to C:L/I:L with no availability impact, consistent with a form-field stored XSS running script in a victim's browser rather than compromising the server. EPSS reinforces the low urgency at 0.25% (15th percentile), and there is no CISA KEV listing and no public exploit code. The signals are consistent - moderate CVSS, low EPSS, no exploitation evidence - so there is no conflict to flag; this is a real-but-low-severity finding, not a high-CVSS/low-real-risk mismatch. No SSVC decision point data was supplied in the input, so exploitation status is assessed purely from KEV/POC absence.

A low-privileged authenticated AEM user (e.g., a content author or form editor) injects malicious JavaScript into a vulnerable form field that is persisted server-side. When a victim - such as an administrator or another authenticated user - later browses to the page rendering that field, the stored script executes in their browser session, enabling session/cookie theft or actions in the victim's context. No public proof-of-concept exploit has been identified at time of analysis.