Adobe Experience Manager CVE-2025-64847

Requires an authenticated low-privileged AEM account (PR:L) with the ability to enter/store content into one of the vulnerable form fields, plus a victim who must subsequently browse to the page rendering that field (UI:R). Affects Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS. Exploitation is limited by both the authentication requirement and the mandatory victim interaction; it is not exploitable pre-auth or without a victim viewing the injected content. Payload persists server-side once stored, so no timing/race is needed.

This is a genuine but low-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4 MEDIUM) shows the flaw is network-reachable but doubly gated: it requires an authenticated low-privileged attacker (PR:L) to store the payload and requires a victim to browse to the affected page (UI:R). The scope change (S:C) reflects the classic XSS crossing from the app into the victim's browser context, but impact is capped at C:L/I:L with no availability impact. Exploitation signals reinforce low urgency: EPSS is 0.20% (9th percentile), there is no CISA KEV listing, and no public exploit code was identified. No SSVC framing is provided in the input. All signals are internally consistent - no conflict between the CVSS vector and the description, both point to a stored client-side XSS. Bottom line: a real, patch-worthy defect in an enterprise CMS but not a high real-world priority; it warrants routine patching rather than emergency response.

A low-privileged AEM author or form-editor with content-entry rights injects a malicious JavaScript payload into a vulnerable form field, which AEM stores and later renders unescaped. When a higher-privileged user or other visitor browses to the page containing that field, the script executes in their browser, enabling session-token theft or actions in the victim's authenticated context. No public POC or active exploitation has been identified.