Adobe Experience Manager CVE-2025-64801

Exploitation requires (1) an authenticated account with at least low privileges sufficient to submit/edit content into an affected AEM form field, and (2) required victim interaction - a separate user must navigate to the page rendering the stored payload for the script to fire. It affects AEM 6.5.23 and earlier, including AEM Cloud Service and AEM 6.5 LTS. These two gates (authentication + victim browse) meaningfully limit real-world risk; there is no unauthenticated or zero-click path, and impact is confined to the victim's browser (scope-changed C:L/I:L), not server-side code execution.

This is a genuine but LOW-priority issue despite its MEDIUM 5.4 CVSS. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N is doubly gated: it requires an authenticated low-privileged attacker (PR:L) AND victim interaction (UI:R) - a victim must browse to the page hosting the poisoned form field. Impact is limited to C:L/I:L with no availability effect, consistent with a stored XSS running in the victim's browser rather than server compromise. EPSS reinforces the low real-world urgency at 0.25% (15th percentile), and there is no CISA KEV listing and no public exploit code identified. No SSVC decision data was supplied. All signals are mutually consistent - there is no conflict between CVSS, EPSS, and KEV: modest severity, low exploitation probability, no known exploitation. The one caveat is that Adobe's advisory (APSB25-115) is bundled and does not enumerate a specific fixed build here, so the exact patched version is not independently verifiable from the provided data.

A low-privileged AEM author or form-capable user injects a malicious JavaScript payload into a vulnerable form field, which AEM stores and later renders unescaped. When a higher-privileged user or another visitor browses to the page containing that field, the script executes in their browser session, enabling session/cookie theft or actions in their AEM context. No public proof-of-concept exploit has been identified at time of analysis.