Adobe Experience Manager
CVE-2025-64817
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged AEM user
-
DeliveryInject script into vulnerable form field
-
ExploitPayload stored in repository
-
ExecutionVictim browses affected page
-
PersistScript executes in victim browser
-
ImpactSession/context compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires: (1) an authenticated account with at least low-privilege authoring access to AEM (PR:L) - not exploitable by anonymous users; (2) the ability to write to a vulnerable form field that stores unsanitized input; and (3) victim user interaction (UI:R) - a separate user must navigate to the page rendering the injected field for the stored JavaScript to execute. Affected deployments are Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and the AEM 6.5 LTS line. These prerequisites (valid credentials plus victim browsing) substantially limit realistic exploitation versus an unauthenticated flaw. |
| Impact | This is a high-CVSS-context-but-low-real-risk issue. The CVSS 3.1 base score is 5.4 (MEDIUM), and every signal confirms limited real-world urgency. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N is double-gated: it requires an authenticated low-privileged attacker (PR:L) AND victim user interaction (UI:R - the victim must browse to the page containing the injected field). Impact is only C:L/I:L with no availability impact, consistent with a stored XSS that runs script in a victim's browser rather than compromising the server. EPSS is very low at 0.20% (9th percentile), there is no CISA KEV listing, and no public exploit code was identified - exploitation status is 'no public exploit identified at time of analysis'. All signals align (no conflict): low EPSS, no KEV, no POC, and a double-gated MEDIUM vector. This should be patched as part of routine Adobe security maintenance (APSB25-115) but is not an emergency. The scope change (S:C) - script crossing from the injected field into the victim's browser security context - is the only element that nudges severity above a pure LOW. |
| Exploit ScenarioDerived | A low-privileged authenticated AEM author injects malicious JavaScript into a vulnerable form field. When another user (e.g., an admin or editor) later browses to the page rendering that field, the stored script executes in their browser, enabling session/cookie theft or actions in their authenticated context. No public proof-of-concept exploit has been identified for this specific CVE. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets an authenticated low-privileged author inject malicious JavaScript into persistent form fields, which then executes in the browser of any user who views the affected page. Exploitation requires valid authoring credentials (PR:L, so unauthenticated attackers are excluded), a writable vulnerable form field, and a separate victim's interaction with the rendered page (UI:R); these prerequisites substantially limit realistic risk despite the context-dependent CVSS base of 5.4. No public exploit code has been identified and EPSS is 0.20% (9th percentile), and this CVE is not listed in CISA KEV, so there is no evidence of active exploitation at time of analysis. Affected deployments include AEM 6.5.23 and earlier, the AEM 6.5 LTS line, and AEM as a Cloud Service.
RemediationAI
Apply the fixed release documented in Adobe's security bulletin for this issue (APSB25-115, https://helpx.adobe.com/security/products/experience-manager/apsb25-115.html); the provided data does not enumerate an exact patched version string, so confirm the minimum safe build/service-pack level against that advisory before signing off. AEM as a Cloud Service customers are typically updated automatically by Adobe and should verify their instance is on the current release rather than applying a manual patch. Because the flaw is stored XSS requiring low-privilege authoring access, the most effective short-term control is to review and minimize which accounts hold form-authoring or content-editing rights, removing or downgrading accounts that do not strictly need them - a change that reduces attack surface but can disrupt editorial workflows. As additional compensating controls, enable a restrictive Content-Security-Policy on rendering tiers to blunt inline script execution, keep the dispatcher/CDN in front of publish instances to limit direct exposure of authoring endpoints, and enable AEM's built-in XSS protection framework and form-field input validation. Note the trade-off that aggressive CSP and sanitization can break legitimate form markup and third-party integrations, so test in a staging environment; do not rely on these as substitutes for the vendor fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored/persistent variant: user-supplied content written into AEM form fields is persisted in the repository and later rendered back to other users without adequate output encoding, so the payload survives beyond the single request that created it. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N indicates network-reachable, low attack complexity, an authenticated low-privilege actor, required victim interaction, and a scope change (S:C) - scope change is meaningful here because the injected script runs in the security context of the victim's browser session rather than the author's, potentially exposing session tokens, authoring interfaces, or administrative actions available to the victim. CPE data maps the affected surface to cpe:2.3:a:adobe:experience_manager with wildcard versions, the aem_cloud_service edition, and the explicit 6.5 lts edition, confirming that both on-premise/managed 6.5 deployments and the hosted Cloud Service are in scope. Content/forms stored by AEM ar
Know when Experience Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Stored XSS by a low-priv author (PR:L) executing in a victim browser on page view (UI:R), crossing security context (S:C) with limited C/I and no availability impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)CVE.org
More in Experience Manager
View allSitecore Experience Manager, Platform, and Commerce versions 9.0 through 10.4 contain a Zip Slip vulnerability that allo
Sitecore PowerShell Extensions through version 7.0 allows authenticated users to upload arbitrary files including ASPX w
Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, wh
Adobe Experience Manager versions 6.5.23.0 and earlier contain a deserialization of untrusted data vulnerability that al
Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 through 10.4.1 contain a hardcoded administr
The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows r
Multiple Sitecore products allow remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remote
Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability. Rated critical severity (CVSS 9.8
Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerabilit
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), S
An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0
An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Comme
GitHub PoC
Exploit-DB