Adobe Experience Manager CVE-2025-64820

Requires a low-privileged but authenticated AEM account with content-authoring capability able to submit data into one of the vulnerable form fields (PR:L). Exploitation is further limited by required victim interaction (UI:R): a second user must navigate to the page rendering the stored payload for the script to execute. Impact is confined to the victim's browser (client-side), with no server-side code execution. Affected deployments are AEM 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS. These two gates (authentication plus victim browsing) substantially reduce realistic risk relative to an unauthenticated, no-interaction XSS.

This is a high-CVSS-context-but-low-real-risk issue in practice. The CVSS 3.1 base score is 5.4 (Medium), and the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N is internally consistent with a stored XSS: network-reachable, low complexity, but double-gated by requiring low privileges (PR:L - an authenticated author/content-editor account) AND victim interaction (UI:R - a victim must browse to the page). The scope change (S:C) reflects script executing in the victim's browser context rather than the server. EPSS is low at 0.25% (15th percentile), indicating no meaningful signal of imminent mass exploitation. There is no CISA KEV listing and no public POC referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided in the input. Signals are consistent, not conflicting: a genuine but low-priority stored XSS in an enterprise CMS. The impact is limited to C:L/I:L/A:N (no server compromise, no confidentiality/integrity breach beyond client-side script effects). The realistic priority is LOW - patch on the normal Adobe quarterly cadence rather than emergency out-of-band.

A low-privileged authenticated AEM author account injects malicious JavaScript into a vulnerable form field. The payload is stored, and when another user (e.g., an admin or content reviewer) browses to the page containing that field, the script executes in their browser, potentially performing actions in their session context. No public exploit code is identified for this specific CVE at time of analysis.