Adobe Experience Manager CVE-2025-64869

Exploitation requires the attacker to hold a low-privileged authenticated account (PR:L) on an Adobe Experience Manager instance (6.5.23 or earlier, including AEM Cloud Service and 6.5 LTS) with permission to submit content into the affected form fields. The payload is stored, so execution additionally depends on a victim user separately navigating to the page that renders the vulnerable field (UI:R). Impact is confined to the victim's browser (C:L/I:L, no availability impact); there is no server-side code execution. The dual requirement of authenticated write access plus victim interaction substantially limits realistic exploitation.

All signals point to a genuinely low-priority issue despite the network attack vector. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4 MEDIUM) is doubly gated: it requires the attacker to already hold low-privilege authenticated access (PR:L) to an AEM authoring environment AND requires a victim to browse to the page containing the injected field (UI:R). Impact is limited to C:L/I:L with no availability effect - a scope change (S:C) reflecting script execution crossing into the victim's browser context, not server compromise. EPSS is very low at 0.20% (9th percentile), there is no CISA KEV listing, and no public POC has been identified. There is no conflict among the signals - CVSS, EPSS, and exploitation status all agree this is a low-real-risk stored XSS. The only genuine gap is that Adobe (psirt@adobe.com) assigned the score and the sole reference is the APSB25-115 advisory; NVD did not independently publish an alternate vector, so the metrics are vendor-supplied but consistent with the description.

A low-privileged authenticated AEM user (e.g. a content author) injects malicious JavaScript into a vulnerable form field. When another user - such as a reviewer or administrator - browses to the page rendering that stored field, the script executes in their browser session, enabling limited session/context theft or UI manipulation. No public exploit code has been identified at time of analysis.