Adobe Experience Manager CVE-2025-64814

Requires an authenticated low-privileged AEM account with the ability to submit or edit content in the affected form fields (PR:L), plus a victim who subsequently browses the page rendering the stored payload (UI:R). Exploitation is therefore double-gated: it is not remote-unauthenticated and cannot fire without victim interaction. Applies to Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS. Impact is confined to the victim's browser session (client-side script execution), limiting confidentiality and integrity to low and with no availability impact.

This is a genuinely low real-world priority despite affecting a widely-deployed enterprise CMS. The CVSS 3.1 base score of 5.4 (MEDIUM) is consistent with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, which I agree with: it is network-reachable but double-gated by PR:L (attacker must already hold a low-privilege authoring/form account) and UI:R (a victim must browse the page hosting the injected script). The S:C scope change reflects that stored script executes in the victim's browser session rather than the injecting attacker's, but impact is limited to C:L/I:L with no availability effect - this is a classic low-impact stored XSS, not a session-takeover or RCE. Exploitation signals reinforce the low priority: EPSS is only 0.25% (15th percentile), there is no CISA KEV listing (not actively exploited), and no public exploit code was identified. All signals are consistent - there is no conflict between a high CVSS and low exploitation likelihood here because the CVSS itself is only medium. Net: patch on a normal cadence; this is a high-CVSS-adjacent but low-real-risk finding, not an emergency.

A low-privileged AEM author or form-editor user injects malicious JavaScript into a vulnerable form field, which is stored server-side. When a higher-privileged administrator or another user later browses the page rendering that field, the script executes in their browser under the AEM origin, enabling session-context actions such as cookie/token theft or limited content manipulation. No public proof-of-concept exploit was identified at time of analysis.