Adobe Experience Manager CVE-2025-64845

Exploitation requires an authenticated low-privileged account on Adobe Experience Manager (PR:L) with the ability to submit content into a vulnerable form field, plus victim user interaction (UI:R) - a second user must navigate to the page rendering the injected field for the stored script to execute. This applies to AEM versions 6.5.23 and earlier, including AEM Cloud Service and AEM 6.5 LTS deployments. Limiting factors: it is not exploitable by anonymous/unauthenticated attackers, it does not fire without a victim visiting the affected page, and impact is confined to low confidentiality and integrity effects in the victim's browser (no server-side compromise or availability impact).

This is a genuinely low-priority issue despite the enterprise footprint of the affected product. All signals align at the low end: the CVSS 3.1 base score is 5.4 (Medium), and the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N shows the attack is double-gated - it requires both low-level authentication (PR:L) AND victim interaction (UI:R, the victim must browse to the affected page). Impact is limited to C:L/I:L with no availability impact. EPSS reinforces this: 0.20% probability at only the 9th percentile, indicating exploitation is highly unlikely relative to other CVEs. There is no CISA KEV listing and no public POC. The scope change (S:C) - script executing in the victim's browser context outside the vulnerable component - is the only factor elevating this above a 4.x score. No signals conflict; the low CVSS, low EPSS, absence of KEV, and absence of POC all point the same direction. This is a legitimate defect worth patching in routine maintenance cycles, not an emergency.

A low-privileged AEM author account injects a malicious JavaScript payload into a vulnerable form field. When another user (e.g., an admin or reviewer) later browses to the page rendering that field, the stored script executes in their browser session, potentially stealing session tokens or performing actions in their context. No public exploit code has been identified at time of analysis, and exploitation requires both authenticated access and victim interaction.