Adobe Experience Manager CVE-2025-64803

Exploitation requires an authenticated low-privileged AEM account (PR:L) with the ability to submit content into one of the vulnerable form fields, plus a separate victim (UI:R) who must navigate to the page that renders the stored payload. It is not exploitable pre-authentication and does not fire without victim interaction. Applies to Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS. Impact is confined to the victim's browser (client-side script execution); there is no server-side code execution or availability impact.

This is a genuinely low-priority issue despite being remotely reachable. The CVSS 3.1 base score of 5.4 (MEDIUM) is doubly gated: PR:L requires the attacker to already hold a low-privileged authenticated AEM account, and UI:R requires a victim to browse to the page hosting the injected field. Impact is limited to C:L/I:L/A:N - a client-side script running in the victim's browser session, not server compromise. EPSS is 0.25% (15th percentile), indicating very low predicted exploitation likelihood; there is no CISA KEV listing and no public POC. All signals align (no conflict): moderate paper score, low exploitation probability, no active exploitation. The scope change (S:C) is inherent to stored XSS crossing the AEM authoring/rendering boundary and does not elevate this to a critical concern. Net: a high-CVSS narrative would be misleading - this is a real-but-low-risk stored XSS best handled in routine patch cycles.

A low-privileged authenticated AEM user (e.g., a content contributor) injects a malicious JavaScript payload into a vulnerable form field. When an administrator or another user later browses to the page rendering that field, the stored script executes in their browser session, enabling session/cookie theft or actions in their AEM context. No public exploit code has been identified at time of analysis.