Adobe Experience Manager CVE-2025-64858

Requires a valid low-privileged authenticated AEM account with access to submit content into the vulnerable form fields (PR:L), plus victim interaction (UI:R) - a separate user must browse to the page rendering the injected field for the stored script to execute. Affects Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and the 6.5 LTS build. Exploitation is limited by the need for both attacker authentication and victim navigation; there is no unauthenticated or fully automated path.

This is a genuine but low-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, 5.4 MEDIUM) is internally consistent with the description: a low-privileged authenticated attacker (PR:L) injects script into form fields that later executes in another user's browser (UI:R, S:C for the browser-context crossing, C:L/I:L for limited stored-XSS impact). Exploitation is double-gated by both a valid low-priv AEM account AND victim interaction (browsing to the affected page). Threat-intel signals reinforce low real-world urgency: EPSS is only 0.20% (9th percentile), there is no CISA KEV listing, and no public POC has been identified. All signals align - there is no conflict between the CVSS vector, EPSS, and KEV status. This is a real-but-modest defense-in-depth fix rather than an emergency, though AEM's enterprise footprint warrants routine patching per Adobe APSB25-115.

A low-privileged AEM author account holder injects a malicious JavaScript payload into a vulnerable form field. The stored script is persisted and later executes in the browser of a higher-privileged user or other victim who navigates to the page containing that field, enabling limited session/data theft in the victim's browser context. No public exploit code has been identified at time of analysis.