Adobe Experience Manager CVE-2025-64825

Requires an authenticated low-privileged AEM account (PR:L) with the ability to write to a vulnerable form field, and a separate victim who must browse to the page rendering that field (UI:R) for the stored script to execute. This is not exploitable against a default configuration by an anonymous remote attacker - it depends on the attacker first holding valid authoring/form-editing credentials on the AEM instance. Limiting factors: authentication requirement, mandatory victim interaction, and impact confined to the browser (C:L/I:L, no availability impact). Affects AEM 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS.

This is a classic high-CVSS-context-but-low-real-risk finding. The CVSS 3.1 base score of 5.4 (MEDIUM) is itself moderate, and the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N shows the score is inflated only by the S:C scope change (stored XSS crossing from the AEM authoring context into the victim's browser security context). Exploitation is doubly gated: it requires an already-authenticated low-privileged attacker (PR:L) to inject the payload AND a separate victim to browse to the affected page (UI:R). Impact is limited to C:L/I:L with no availability effect. EPSS reinforces the low-priority read: 0.25% probability at the 15th percentile, meaning it is estimated less likely to be exploited than ~85% of scored CVEs. There is no CISA KEV listing and no public proof-of-concept identified. No SSVC decision data was provided, but the low automatability (requires per-victim interaction) and partial technical impact both point to a Track/low-priority disposition. Net: real but low-priority - patch in normal cycle, not an emergency.

A low-privileged AEM author or form-editor account injects a malicious JavaScript payload into a vulnerable form field. When another user - for example an administrator or content reviewer - later browses to the page rendering that stored field, the script executes in their browser session under the AEM origin, enabling session-token theft or actions on their behalf. No public exploit code has been identified at time of analysis.