Adobe Experience Manager CVE-2025-64826

Requires an authenticated low-privileged AEM account (PR:L) with the ability to submit or edit content in a vulnerable form field, and a victim who subsequently browses to the page rendering that field (UI:R). Exploitation is limited by the need for prior authentication, the specific vulnerable form components, and victim interaction; it does not work against unauthenticated attackers or without a victim viewing the injected content. Affects AEM on-prem/Managed Services 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS.

This is a classic high-CVSS-context-but-low-real-risk issue: the CVSS 3.1 base score is only 5.4 (MEDIUM) and every real-world signal confirms low priority. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N is doubly gated - it requires an already-authenticated low-privileged account (PR:L) to plant the payload AND a victim to browse the affected page (UI:R). Impact is limited to C:L/I:L with A:N, consistent with a stored XSS that runs script in a victim browser rather than compromising the server. EPSS is 0.25% (15th percentile), indicating low predicted exploitation likelihood. There is no CISA KEV listing and no public POC identified. No SSVC decision data was provided. All signals agree: no active exploitation, low automatability (requires authenticated injection plus victim interaction), and low technical impact. Priority is LOW despite AEM being enterprise software - patch during normal cycle via APSB25-115.

A low-privileged authenticated AEM user (e.g., a content author or form editor) injects malicious JavaScript into a vulnerable form field that is stored server-side. When a higher-privileged user or another visitor later browses to the page rendering that field, the script executes in their browser, potentially stealing session cookies or performing actions in their context. No public exploit code has been identified at time of analysis.