Adobe Experience Manager CVE-2025-64796

Exploitation requires an authenticated account with at least low privileges in Adobe Experience Manager (PR:L) sufficient to submit content into one of the vulnerable form fields, and additionally requires a victim user to navigate to the page rendering that stored field (UI:R). It affects AEM 6.5.23 and earlier, including AEM Cloud Service and the AEM 6.5 LTS branch. These two prerequisites - prior authentication plus victim browsing interaction - meaningfully limit realistic exploitation despite the network attack vector; there is no unauthenticated or zero-interaction path.

This is a high-CVSS-context product but genuinely low real-world risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N = 5.4 MEDIUM) is doubly gated: it requires an authenticated low-privileged attacker (PR:L) to inject the payload AND a victim to browse to the affected page (UI:R), with only low confidentiality/integrity impact and no availability impact. EPSS reinforces the low-priority picture at 0.25% (15th percentile), indicating minimal predicted exploitation activity. There is no CISA KEV listing and no public POC identified, so exploitation status is 'no public exploit identified at time of analysis.' All signals are consistent - there is no conflict between CVSS, EPSS, and KEV/POC data. The scope-change flag (S:C) reflects standard stored-XSS crossing the browser trust boundary rather than any server-side compromise; despite occasional 'RCE' mislabeling of AEM XSS bugs, this is client-side script execution only. Net: a real but low-priority hardening item, prioritized behind unauthenticated or high-impact flaws in the same APSB25-115 batch.

A low-privileged authenticated AEM user (e.g., a content author) enters malicious JavaScript into a vulnerable form field, which is stored server-side. When another user - such as an administrator or reviewer - later browses to the page rendering that field, the script executes in their browser, enabling session-token theft or actions in their AEM context. No public proof-of-concept exploit has been identified, and the attack requires both prior authentication and victim interaction.