Adobe Experience Manager CVE-2025-64792

Exploitation requires an authenticated low-privileged AEM account with the ability to submit/store content into a vulnerable form field (PR:L), and a separate victim who must browse to the page rendering that field for the stored payload to execute (UI:R). It affects Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and the 6.5 LTS branch. These two gates - prior authenticated access plus required victim interaction - substantially limit realistic exploitation despite the network attack vector.

This is a high-CVSS-context product but a genuinely low real-world-risk issue. The CVSS 3.1 base score is 5.4 (MEDIUM), and the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N shows two independent gates: PR:L (attacker must already hold a low-privileged authenticated AEM author account) and UI:R (a victim must browse to the page hosting the injected field). EPSS reinforces the low-priority read: 0.25% probability, 15th percentile - bottom-tier likelihood of exploitation. There is no CISA KEV listing and no public exploit code identified, so exploitation status is speculative only. The scope change (S:C) reflects that injected script runs in the victim's browser context (a different security authority than the vulnerable AEM component), but impact is capped at C:L/I:L with no availability impact. All signals align consistently - moderate CVSS, low EPSS, no KEV, no POC - pointing to a real-but-not-urgent finding best handled in normal patch cycles. No signals conflict; the main uncertainty is the absence of a confirmed fixed version in the referenced advisory.

A low-privileged AEM author-tier user injects a malicious JavaScript payload into a vulnerable form field. When another user (e.g., an editor or reviewer) later navigates to the page rendering that field, the stored script executes in their browser session, enabling session/cookie theft or actions on their behalf. No public proof-of-concept exploit code has been identified.