Adobe Experience Manager CVE-2025-64790

Exploitation requires a valid low-privileged authenticated account on the AEM instance (PR:L) with permission to submit or edit the vulnerable form fields, plus a victim who subsequently browses to the page rendering the injected field (UI:R). The payload is stored and executes in the victim's browser context (scope change S:C, crossing from the attacker's input into the victim's session). Limiting factors: no unauthenticated path, no server-side code execution, no availability impact, and success depends on a higher-value victim actually viewing the affected page. Affects Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS.

This is a classic high-CVSS-context-but-low-real-risk issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, 5.4 MEDIUM) confirms a doubly-gated stored XSS: the attacker must already hold a low-privilege authenticated account (PR:L) AND a victim must browse to the page containing the injected field (UI:R). Impact is limited to C:L/I:L with no availability impact - script execution in the victim's browser session, not server compromise. Exploitation signals are weak and consistent: EPSS is 0.25% (15th percentile), there is no CISA KEV listing, and no public exploit code was identified. No signals conflict here - the low EPSS, absence of KEV, and MEDIUM CVSS all agree this is not an urgent priority. The realistic risk is targeted, not widespread: a malicious insider or a compromised low-priv author account escalating to steal a higher-privileged user's session within the AEM authoring environment. Patch this on a normal cadence via APSB25-115; it is not a drop-everything emergency.

A low-privileged AEM author account injects a malicious JavaScript payload into a vulnerable form field. When a higher-privileged user (e.g., an editor or administrator) later browses to the page rendering that field, the script executes in their authenticated browser session, enabling session/cookie theft or actions on their behalf. No public POC or active exploitation has been identified.