Adobe Experience Manager CVE-2025-64808

Exploitation requires a valid low-privileged AEM account with authoring access to inject payloads into the specific vulnerable form fields (PR:L), and it requires a victim to subsequently browse to the page rendering that stored field (UI:R) for the script to execute. It is therefore not exploitable pre-authentication or without victim interaction. Affected deployments are Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and the 6.5 LTS branch; the flaw is a stored XSS in form-field handling, so instances exposing user-editable form components to lower-trust authors are most at risk.

This is a high-CVSS-context product but genuinely low real-world risk. The CVSS 3.1 base score is 5.4 (MEDIUM), and the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N is internally consistent with a stored XSS: network-reachable, low complexity, but double-gated by requiring low-privilege authentication (PR:L) AND victim interaction (UI:R, the victim must browse to the page with the poisoned field). Impact is limited to C:L/I:L with no availability effect. EPSS is 0.25% (15th percentile), indicating very low predicted exploitation probability, and there is no CISA KEV listing and no public exploit - status is 'no public exploit identified at time of analysis.' All signals align rather than conflict: modest CVSS, low EPSS, no KEV, no POC. The scope change (S:C) is the only elevating factor, reflecting that injected script executes in the victim's browser security context rather than the server's. Net: patch in the normal Adobe quarterly cycle; this is not an emergency. No signals are missing beyond SSVC, which is not supplied but would almost certainly rate this Track/low-automatable given the authentication and interaction gates.

A low-privileged authenticated AEM author account injects a malicious JavaScript payload into a vulnerable form field, which is stored server-side. When a higher-privileged user or another victim later browses to the page rendering that field, the script executes in their browser, enabling session token theft or actions on their behalf. No public exploit code is currently identified, and the attack requires both valid credentials and victim page-view interaction.