Adobe Experience Manager CVE-2025-64857

Exploitation requires an authenticated low-privileged AEM account with the ability to submit or edit content in the affected form fields (PR:L), and additionally requires a victim to browse to the page containing the injected field (UI:R) for the stored payload to fire. It affects Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS. It is not exploitable by fully unauthenticated attackers and does not fire without victim interaction, which materially limits real-world risk below the raw network-vector reading.

This is a low-real-priority issue despite its network attack vector. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4 Medium) shows exploitation is doubly gated: the attacker must already hold a low-privilege authenticated account (PR:L) capable of writing to form fields, and a victim must then browse to the poisoned page (UI:R). Impact is limited (C:L/I:L/A:N) - a scope change (S:C) reflects that injected script crosses from the stored content into the victim's browser trust context, but it is client-side script execution, not server compromise. EPSS is very low at 0.20% (9th percentile), there is no CISA KEV listing, and no public exploit code was identified, so all real-world signals point to opportunistic/theoretical rather than active exploitation. No SSVC decision data was provided in the input. There are no conflicting signals: the CVSS network vector is consistent with a web-based stored-XSS delivered over HTTP(S) to the AEM authoring/rendering surface. Net: a legitimate hardening fix, not an emergency - appropriate for routine patch cycles.

A low-privileged AEM author or form-editor user injects a malicious JavaScript payload into a vulnerable form field that is stored server-side. When a higher-privileged user or another visitor later browses to the page rendering that field, the script executes in their browser session, enabling actions such as session/cookie theft or UI redress within the AEM context. No public proof-of-concept exploit was identified at time of analysis.