Adobe Experience Manager CVE-2025-64822

Requires an authenticated low-privileged account on the AEM instance (PR:L) with the ability to submit data into one of the vulnerable form fields; the stored payload only fires when a victim subsequently navigates to the page rendering that field (UI:R), so it is not self-triggering. Limiting factors: attacker must already have valid author/contributor-level access to the AEM authoring environment, a separate victim must visit the affected page, and only AEM 6.5.23 and earlier (including AEM Cloud Service and 6.5 LTS) are affected. No availability impact and only limited confidentiality/integrity impact result.

This is a high-CVSS-in-name-only issue that lands squarely at MEDIUM (5.4) and is LOW real-world priority. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N is doubly gated: it requires an authenticated low-privileged attacker (PR:L) to plant the payload AND a victim to browse to the affected page (UI:R), with only Low confidentiality/integrity impact and no availability impact. Scope is Changed (S:C) because injected script executes in the victim's browser context rather than the server's. Exploitation signals are weak and mutually consistent: EPSS is 0.25% (15th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis. No SSVC decision was supplied, but the low technical impact and non-automatable, interaction-dependent flow argue against prioritization. No signals conflict here - CVSS, EPSS, and the absence of KEV/POC all point the same direction: a genuine but low-severity stored XSS meriting routine patching, not emergency response. The only elevating factor is that AEM is enterprise-grade software often holding sensitive content, so the flaw should not be dismissed outright.

A low-privileged AEM author account (e.g. a content contributor) enters a crafted JavaScript payload into a vulnerable form field, which is stored server-side. When a higher-privileged user or another visitor later browses to the page rendering that field, the script executes in their browser, enabling session-token theft or actions in the victim's authenticated context. No public proof-of-concept exploit has been identified for this specific CVE.