Adobe Experience Manager CVE-2025-64821

Exploitation requires: (1) a valid low-privileged AEM account with permission to write to a vulnerable form field (PR:L - not exploitable by fully anonymous users); (2) the injected payload to persist in a form field that AEM renders without adequate output encoding; and (3) a victim user to subsequently browse to the page containing the poisoned field (UI:R - no execution without victim interaction). This affects AEM 6.5.23 and earlier, AEM Cloud Service, and the 6.5 LTS line. The authentication requirement and mandatory victim interaction are the primary factors limiting real-world exploitation.

Multiple signals converge on LOW real-world priority despite this being an enterprise-product flaw. The CVSS 3.1 base score is 5.4 (MEDIUM) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - network-reachable and low-complexity, but doubly gated by PR:L (attacker must hold a low-privileged authenticated account) and UI:R (a victim must browse to the page hosting the poisoned form field). The scope change (S:C) reflects script executing in the victim's browser security context, but confidentiality and integrity impact are only Low and availability is None, so this is not a session-takeover-class XSS (contrast the unauthenticated C:H/I:H 9.3 siblings in the same APSB25-115 batch, e.g. CVE-2025-64537/64539). EPSS is 0.25% (15th percentile) - low predicted exploitation probability. There is no CISA KEV listing and no public POC identified. No SSVC decision data was supplied. Net: the two-factor gating (valid credentials + victim interaction) plus modest technical impact make this a routine patch-in-cycle item, not an emergency - a genuinely MEDIUM-CVSS-but-LOW-real-risk stored XSS.

A low-privileged authenticated AEM author submits content into a vulnerable form field, embedding a malicious JavaScript payload that is stored server-side. When another user (e.g. an editor or reviewer) later browses to the page rendering that field, the script executes in their browser session, enabling limited theft of session data or actions within the AEM UI context. No public exploit code has been identified for this specific CVE.