Adobe Experience Manager CVE-2025-64800

Exploitation requires an authenticated low-privileged account on the AEM instance (PR:L, e.g. an author/content-contributor role) with the ability to submit data into one of the vulnerable form fields, plus a second victim user who must navigate to the page rendering that stored field (UI:R). This is a stored XSS, so the payload persists and fires on page view rather than requiring a crafted link. Limiting factors: it is not exploitable pre-authentication, impact is confined to client-side script execution in the victim's browser (C:L/I:L, no server RCE, no availability impact), and it depends on the attacker having write access to a susceptible field - so instances that restrict authoring privileges materially reduce exposure.

This is a high-CVSS-context product but genuinely low real-world priority. The CVSS 3.1 base score of 5.4 (MEDIUM) is well-calibrated: the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N reflects a stored XSS that is double-gated - it requires an authenticated low-privileged attacker (PR:L) to inject the payload AND a victim to browse to the affected page (UI:R), with only Low confidentiality/integrity impact and no availability impact. EPSS reinforces the low urgency at 0.20% (9th percentile), among the lowest exploitation-probability signals. There is no CISA KEV listing and no public proof-of-concept identified. All signals are consistent and point the same direction - no conflicts between CVSS, EPSS, and exploitation status. The scope change (S:C) is the standard XSS convention (payload executes in the browser DOM, a different security authority than the Sling/OSGi server), not evidence of server compromise. Bottom line: real but low priority; patch in normal cycle rather than emergency.

A low-privileged AEM author or content contributor injects a malicious JavaScript payload into a vulnerable form field. The script is stored and later executes in the browser of another user (e.g., an admin or reviewer) who navigates to the page rendering that field, enabling session/token theft or actions in the victim's authenticated context. No public exploit code has been identified at time of analysis.