Adobe Experience Manager CVE-2025-64797

Exploitation requires an authenticated low-privileged AEM account (PR:L) with the ability to submit content into a vulnerable form field, plus a victim who subsequently browses to the page rendering that field (UI:R). It affects AEM 6.5.23 and earlier, including AEM Cloud Service and AEM 6.5 LTS per the CPEs. The stored nature means the attacker must have write access to a persisted field and cannot trigger execution without a victim visiting the affected page - both the authentication requirement and the required user interaction meaningfully limit realistic exploitation.

This is a genuine but low-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4 MEDIUM) is internally consistent with the description: a stored XSS requiring both authentication (PR:L, low-privileged AEM author/content account) and victim interaction (UI:R, a user must browse to the affected page). Scope-changed (S:C) reflects script executing in the victim's browser security context, but confidentiality and integrity impact are only Low (C:L/I:L) and there is no availability impact. EPSS is 0.25% (15th percentile), consistent with the absence of any public exploit or KEV listing - there is no evidence of active exploitation and no automatable mass-exploitation path (stored XSS requires per-target injection plus victim browsing). No signals conflict: low CVSS, low EPSS, no KEV, no POC all point the same direction. This should be patched in normal cycles, not as an emergency; the double gating (authentication + user interaction) substantially limits real-world exploitability despite AEM being a high-value enterprise CMS.

A low-privileged AEM author account injects malicious JavaScript into a vulnerable form field, which is stored server-side. When another user (e.g., an administrator or reviewer) later browses to the page rendering that field, the script executes in their browser, enabling session token theft or actions on their behalf within AEM. No public exploit code has been identified at time of analysis.