Adobe Experience Manager
CVE-2025-64823
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged AEM user
-
DeliveryInject script into vulnerable form field
-
ExploitVictim browses to affected page
-
ExecutionMalicious JS executes in victim browser
-
ImpactSession/data theft in victim context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account with at least low-privilege content-authoring access to AEM (PR:L) capable of writing to the affected form fields, plus a victim who must subsequently browse to the page containing the injected field (UI:R). Affected deployments are AEM 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS. It is not exploitable pre-authentication or without victim interaction, which materially limits real-world risk. Impact is confined to the victim's browser (client-side script execution); there is no direct server-side code execution. |
| Impact | This is a high-CVSS-context-but-low-real-risk issue. The CVSS 3.1 base score is 5.4 (MEDIUM), and the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N is internally consistent with a stored XSS: network-reachable, low complexity, but double-gated by requiring low-privilege authentication (PR:L) AND victim interaction (UI:R, the victim must browse to the page). Impact is limited to C:L/I:L with A:N, reflecting client-side script execution in a victim browser rather than server compromise. EPSS is very low at 0.25% (15th percentile), there is no CISA KEV listing and no public POC identified, so exploitation status is 'no public exploit identified at time of analysis.' All signals align consistently - there is no conflict between CVSS, EPSS, and exploitation data. The double authentication/interaction gating plus low technical impact makes this a routine patch-cycle item, not an emergency, despite AEM being a widely deployed enterprise CMS. This is one of a large batch of near-identical stored-XSS findings in APSB25-115. |
| Exploit ScenarioDerived | A low-privileged authenticated AEM user (e.g., a content author) injects malicious JavaScript into a vulnerable form field. When a victim - such as an administrator or another user - later browses to the page rendering that field, the script executes in their browser session, potentially stealing session tokens or performing actions as the victim. No public exploit code is currently available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service lets a low-privileged but authenticated content author plant malicious JavaScript inside vulnerable form fields; the script then executes in the browser of any user who later opens the affected page. Exploitation requires both an authoring-level account (PR:L) and a victim who browses to the poisoned page (UI:R), so it cannot be triggered pre-authentication or without user interaction, and impact is confined to the victim's browser with no server-side code execution. EPSS is very low (0.25%, 15th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, making this a low real-world-risk issue despite the recorded CVSS score of 5.4.
RemediationAI
Apply the update described in Adobe security bulletin APSB25-115 (https://helpx.adobe.com/security/products/experience-manager/apsb25-115.html); the bulletin is the authoritative source for the exact patched version for each track, and any AEM instance still on 6.5.23 or earlier must be moved to the fixed release for its release line. Adobe-hosted AEM Cloud Service customers typically receive fixes automatically, so verify the applied cloud version rather than assuming exposure persists. Where immediate upgrade is not possible, compensating controls should focus on the preconditions: restrict content-authoring and form-submission privileges (PR:L) to the smallest set of trusted users, tighten AEM ACLs and workflow permissions so untrusted accounts cannot write to form fields, and enforce a strict Content Security Policy on rendered pages to blunt inline script execution - noting that a permissive CSP or reliance on legacy inline scripts will weaken this mitigation. Input validation and output-encoding filters on form fields, plus WAF rules targeting script payloads in form submissions, reduce but do not eliminate the risk, since sophisticated payloads can bypass signature-based filtering and legitimate form content may be blocked as false positives.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored/persistent XSS variant: attacker-supplied content written into AEM form fields is persisted server-side and rendered back to other users without adequate sanitization or output encoding. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N indicates a network-reachable issue that requires low-privileged authenticated access and victim interaction, with a scope change (S:C) reflecting that the injected script executes in the victim's browser context rather than the application's own security context. Confidentiality and integrity impacts are limited (C:L/I:L) and availability is unaffected (A:N), which matches the profile of a client-side script-injection bug rather than a server compromise. The affected technology is the Adobe Experience Manager content management and digital experience platform, including its form-authoring components; affected CPE coverage spans the general AEM release train (cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*), the hosted AEM Cloud Service track (cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*), and the 6.5 LTS line (cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:*).
Know when Experience Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Stored XSS reachable over network with low complexity, but requires low-priv authenticated injection (PR:L) and victim interaction (UI:R); scope change (S:C) and low C/I impact from browser-context script.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)CVE.org
More in Experience Manager
View allSitecore Experience Manager, Platform, and Commerce versions 9.0 through 10.4 contain a Zip Slip vulnerability that allo
Sitecore PowerShell Extensions through version 7.0 allows authenticated users to upload arbitrary files including ASPX w
Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, wh
Adobe Experience Manager versions 6.5.23.0 and earlier contain a deserialization of untrusted data vulnerability that al
Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 through 10.4.1 contain a hardcoded administr
The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows r
Multiple Sitecore products allow remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remote
Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability. Rated critical severity (CVSS 9.8
Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerabilit
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), S
An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0
An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Comme
GitHub PoC
Exploit-DB