Adobe Experience Manager CVE-2025-64829

Requires a low-privileged authenticated AEM account (PR:L) able to submit/edit content in the affected form fields, plus victim interaction (UI:R): a user must browse to the page rendering the injected field for the stored script to execute. Applies to AEM 6.5.23 and earlier, including AEM Cloud Service and AEM 6.5 LTS. Limiting factors: the attacker needs an existing account with content-authoring capability, the payload only fires when a victim visits the affected page, and impact is confined to Low confidentiality/integrity in the victim's browser (no availability impact, no direct server compromise).

All available signals point to a genuine-but-low real-world priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4 MEDIUM) reflects a stored XSS that is double-gated: it requires low-privilege authentication (PR:L) to inject the payload AND victim user interaction (UI:R) - a victim must browse to the page containing the poisoned form field. The scope change (S:C) correctly captures that injected script executes in the victim's browser security context rather than the server's, but confidentiality and integrity impacts are only Low (C:L/I:L) and availability is unaffected (A:N). Exploitation likelihood signals are weak and mutually consistent: EPSS is just 0.20% (9th percentile), there is no CISA KEV listing, and no public exploit code is identified. No SSVC decision data was provided. There is no conflict between signals here - a low EPSS aligns with the absence of KEV/POC and with the practical friction of needing both an authenticated foothold and victim interaction. This is a legitimate defect to patch in the normal cycle, not an emergency. The main risk amplifier is deployment context: AEM is a high-value enterprise CMS, and a low-priv author account (common in large content teams) turning into stored script execution against higher-privileged reviewers/admins is a plausible privilege-escalation stepping stone. Note the input contains no explicit patch version - remediation maps to Adobe bulletin APSB25-115.

A low-privileged AEM author or content contributor injects a malicious JavaScript payload into a vulnerable form field. When a higher-privileged user (e.g., an editor or administrator) later browses to the page rendering that field, the script executes in their authenticated browser session, enabling session/token theft or actions on their behalf. No public exploit code has been identified, and exploitation requires both the authenticated foothold and the victim visiting the affected page.