Adobe Experience Manager CVE-2025-64839

Requires a valid low-privileged AEM account with authoring access to inject script into a vulnerable form field (PR:L), and requires a victim to subsequently browse the page rendering that field for the stored payload to execute (UI:R). Exploitation is limited to Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and the 6.5 LTS build. Realistic risk is constrained by the need for both prior authentication and victim interaction; it is not exploitable against an unauthenticated attacker or without a victim visiting the affected page.

This is a genuinely LOW-priority issue despite carrying a MEDIUM 5.4 CVSS score. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N is doubly gated: the attacker must already hold a low-privileged authenticated AEM account (PR:L) capable of writing to form fields, and a victim must then browse to the page containing the injected payload (UI:R). Impact is limited to C:L/I:L with A:N - a scope-change (S:C) stored XSS that runs script in the victim's browser context, not server compromise. All exploitation signals reinforce low real-world risk: EPSS is 0.20% (9th percentile), there is no CISA KEV listing, and no public POC has been identified. No SSVC decision data was supplied, but the low automatability (requires authenticated injection plus victim interaction) and partial technical impact both point to Track/low-priority handling. No signals conflict: the low EPSS, absent KEV, and low impact metrics are all mutually consistent. Prioritize behind any unauthenticated or higher-impact AEM findings in the same APSB25-115 batch (e.g., the 9.3 DOM-XSS session-takeover CVEs).

A low-privileged AEM author with access to a form-authoring component injects a malicious JavaScript payload into a vulnerable form field, which is stored persistently. When another user - such as a higher-privileged editor or a site visitor - navigates to the page rendering that field, the script executes in their browser, enabling session-token theft or actions in their authenticated context. No public exploit code has been identified at time of analysis, and the attack requires both a valid account and victim page interaction.