Adobe Experience Manager CVE-2025-64799

Requires a low-privileged authenticated account on the AEM instance (PR:L) with permission to submit or edit content into the vulnerable form fields, and requires a victim to subsequently browse to the page rendering the injected field (UI:R). Exploitation is limited by these two conditions plus the stored payload only affecting users who view the specific affected page; impact is confined to client-side script execution in the victim's browser (no server-side code execution). Affects AEM 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS.

This is a genuine but low-priority vulnerability. The CVSS 3.1 score of 5.4 (MEDIUM) is well-calibrated: the AV:N/AC:L vector is offset by two significant gates - PR:L (the attacker must already hold a low-privileged authenticated account, typical of an internal AEM author/contributor) and UI:R (a victim must actually browse to the page hosting the injected form field). Impact is limited to C:L/I:L with A:N and a scope change (S:C) reflecting script execution in the victim's browser context rather than server compromise. Exploitation signals confirm low real-world urgency: EPSS is 0.25% (15th percentile), there is no CISA KEV listing, and no public exploit code has been identified. No SSVC decision data was provided. All signals are consistent - there is no CVSS-vs-EPSS or KEV conflict here. Net: a real defect worth patching in the normal Adobe cycle, but not a drop-everything priority given the double gating (authentication + user interaction) and low technical impact.

A low-privileged AEM author or content contributor injects a malicious JavaScript payload into a vulnerable form field. When a higher-privileged user or another visitor later browses to the page rendering that field, the stored script executes in their browser, enabling session/cookie theft or limited actions in their context. No public proof-of-concept is currently known.