Adobe Experience Manager CVE-2025-64833

Exploitation requires an authenticated low-privileged AEM account (author/contributor tier) with permission to submit content into one of the affected form fields - it is NOT unauthenticated. The stored payload only executes when a victim user actively navigates to the page containing the vulnerable field (UI:R), so successful attack also depends on a victim with browser access to that page, ideally a higher-privileged admin to make the scope change (S:C) impactful. Affected deployments are AEM 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS. Limiting factors: two-party gating (attacker must be a provisioned author and a victim must view the content), low confidentiality/integrity impact and no availability impact, and no automatable mass-exploitation path.

This is a genuine-but-low-priority issue where the raw CVSS 5.4 (Medium) already reflects meaningful gating, and every corroborating signal points the same direction. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N shows a network-reachable flaw but double-gates exploitation: PR:L requires an authenticated low-privileged author/contributor account, and UI:R requires a victim to browse to the page hosting the malicious field. Impact is only C:L/I:L with A:N, consistent with a stored XSS that runs script in a victim's browser session rather than compromising the server. EPSS is very low at 0.20% (9th percentile), there is no CISA KEV listing, and no public exploit code is identified - so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision point is supplied in the input. Signals are consistent, not conflicting: low EPSS, no KEV, no POC, and a self-limiting CVSS all agree this is a real vulnerability worth patching in the maintenance cycle but not an emergency. The primary real-world risk is an insider or a compromised low-privilege authoring account persisting script that fires against higher-privileged admins in the same authoring environment (scope-change S:C).

A low-privileged authenticated user (e.g., a content author) submits a payload containing malicious JavaScript into a vulnerable AEM form field, which is stored persistently. When another user - potentially a higher-privileged administrator - later browses to the page rendering that field, the script executes in their browser, enabling session token theft or actions in their context. No public proof-of-concept exploit code has been identified for this specific CVE.