Adobe Experience Manager CVE-2025-64853

Exploitation requires an authenticated account with at least low-privilege authoring access to AEM (PR:L) to inject the stored payload into a vulnerable form field, AND a separate victim who must browse to the page containing that field (UI:R) for the script to fire. It affects AEM 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS. The double requirement - pre-existing authoring credentials plus victim interaction - significantly limits realistic exploitation; it cannot be triggered unauthenticated or without a victim visiting the injected page.

This is a genuine but LOW-priority vulnerability despite its network attack vector. All signals converge on limited real-world risk: the CVSS 3.1 score of 5.4 (MEDIUM) reflects that exploitation requires both low-level authentication (PR:L) and victim interaction (UI:R), with only partial confidentiality and integrity impact (C:L/I:L) and no availability impact. The scope change (S:C) - script executing in the victim's browser context rather than the server - is what nudges this above a pure 4.x. EPSS reinforces this: 0.20% probability at only the 9th percentile, indicating exploitation is considered very unlikely relative to other CVEs. There is no CISA KEV listing and no public exploit code identified. No signals conflict here - CVSS, EPSS, and the absence of KEV/POC all agree this is a low-real-risk stored XSS that is double-gated (attacker must already have a low-privilege authoring account AND must lure a victim to view the injected field). It is a legitimate patch-in-normal-cycle item, not an emergency.

A low-privileged authenticated user (e.g., a content author or form editor) injects malicious JavaScript into a vulnerable AEM form field. When another user - such as an administrator or another author - browses to the page containing that field, the stored script executes in their browser, potentially stealing session tokens or performing actions in their context. No public proof-of-concept exploit is currently available.