Adobe Experience Manager CVE-2025-64802

Requires an authenticated low-privileged AEM account with the ability to submit/edit content in the affected form fields (PR:L). Exploitation is not automatic: a victim user must subsequently browse to the page rendering the injected field (UI:R), so the payload only fires on that interaction. Affects Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and the 6.5 LTS branch. Limiting factors: two independent gates (attacker authentication plus victim navigation) substantially reduce real-world exploitability versus an unauthenticated remote flaw, and impact is confined to the victim's browser session (C:L/I:L, no availability impact).

This is a genuine-but-low-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N = 5.4 Medium) is double-gated: it requires an authenticated low-privileged account (PR:L) AND victim user interaction (UI:R) - a victim must browse to the page bearing the injected payload. Impact is limited to C:L/I:L with no availability impact, and the scope change (S:C) reflects script execution crossing into the victim's browser context, which is standard for stored XSS. Exploitation signals are uniformly cold: EPSS is 0.25% (15th percentile), there is no CISA KEV listing, and no public exploit code was identified. All signals agree - this is a real-but-modest issue, not a high-CVSS-low-real-risk mismatch nor an urgent priority. SSVC framing: exploitation=none observed, automatable=no (requires authenticated injection plus victim interaction), technical impact=partial. Bottom line: patch on a normal cycle, not an emergency.

A low-privileged authenticated AEM user (e.g., a content author or form editor) injects malicious JavaScript into a vulnerable form field. The payload is stored and later executed in the browser of any victim - such as an administrator or reviewer - who navigates to the page containing that field, enabling session-context actions like cookie theft or CSRF within the victim's authenticated session. No public proof-of-concept exploit was identified at time of analysis.