Adobe Experience Manager CVE-2025-64804

Exploitation requires an authenticated account with low privileges sufficient to submit or edit the affected AEM form fields (PR:L), so it is not exploitable by anonymous outsiders against a default hardened deployment. The stored payload only triggers when a victim navigates to the page containing the vulnerable field (UI:R), meaning a valid content-authoring or form-input path must exist and be reachable by a victim. Affected deployments are AEM 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS. Limiting factors: required prior authentication, required victim page visit, and impact confined to the browser (C:L/I:L, no A) rather than server compromise.

This is a genuine but low-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) scores 5.4 (MEDIUM) and is internally consistent with a stored XSS: network-reachable, low complexity, but double-gated by requiring both low-privilege authentication (PR:L) and victim interaction (UI:R - a victim must browse to the affected page). Impact is capped at C:L/I:L with no availability effect. Exploitation signals are weak and mutually reinforcing: EPSS is 0.25% (15th percentile), there is no CISA KEV listing, and no public POC is referenced - no public exploit identified at time of analysis. No SSVC decision data was provided. There are no conflicting signals: the low EPSS aligns with the modest CVSS and the lack of KEV/POC. Net assessment: a real defect worth patching in the normal Adobe security cycle, not an emergency; the enterprise footprint of AEM raises attention but the authentication + user-interaction gating and low impact keep real-world priority LOW.

A low-privileged authenticated AEM user (e.g., a content author or form editor) injects a malicious script payload into a vulnerable form field. When a higher-privileged user or another victim later browses to the page rendering that field, the stored JavaScript executes in their browser, enabling session/cookie theft or actions in the victim's AEM context. No public proof-of-concept is known, and exploitation requires the victim to visit the affected page.