Adobe Experience Manager CVE-2025-64840

Exploitation requires an authenticated low-privileged AEM account (PR:L) with the ability to write to the vulnerable form field, and it requires victim user interaction (UI:R) - a victim must browse to the page rendering the injected field for the stored payload to execute. This is not remotely exploitable against a default configuration by an unauthenticated attacker; the attacker must already possess authoring/content-entry access to the affected AEM instance (6.5.23 or earlier, including AEM Cloud Service and 6.5 LTS). Impact is confined to client-side script execution in the victim's browser (no server-side code execution).

This is a genuinely low-priority issue despite a MEDIUM 5.4 CVSS. All exploitation signals point to constrained, low-impact risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) is double-gated: it requires an authenticated low-privileged account (PR:L) AND victim user interaction (UI:R) - a victim must browse to the page hosting the injected field. The scope change (S:C) reflects that injected JavaScript escapes into the victim's browser context, but impact is only C:L/I:L with no availability effect. EPSS is 0.20% (9th percentile), among the lowest exploitation-probability bands, consistent with a stored XSS that has no automatable mass-exploitation path. There is no CISA KEV listing and no public exploit identified. No signals conflict here: the low EPSS, absence of KEV/POC, and the double-gated vector all reinforce that this is a real but low-urgency finding - patch on the normal Adobe cadence rather than emergency-escalate. It is one of a large batch of near-identical AEM stored/DOM XSS issues disclosed together under APSB25-115.

A low-privileged authenticated AEM author injects a malicious script payload into a vulnerable form field. When a higher-privileged user or another visitor later browses to the page rendering that field, the stored JavaScript executes in their browser, enabling session-context actions such as cookie/token theft or CSRF-style requests. No public proof-of-concept exploit is identified at the time of analysis.