Adobe Experience Manager CVE-2025-64875

Requires a low-privileged but authenticated AEM account with write access to one of the vulnerable form fields (PR:L) - this is not remotely reachable by an anonymous attacker. Exploitation is further limited by required victim interaction: a second user must navigate to the page hosting the injected field (UI:R) before the stored payload executes. Applies to Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and the 6.5 LTS build. Impact is confined to the victim's browser session (C:L/I:L, A:N); there is no direct server-side code execution.

This is a genuinely low-priority issue despite a MEDIUM 5.4 CVSS score. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N is doubly gated: the attacker must already hold a low-privileged authenticated AEM account (PR:L) capable of writing to a vulnerable form field, AND a victim must subsequently browse to the page (UI:R) for the stored script to fire. Impact is capped at C:L/I:L with no availability impact - this is browser-side script execution in a victim's session, not server compromise. Exploitation signals reinforce low real-world urgency: EPSS is 0.20% (9th percentile), there is no CISA KEV listing, and no public proof-of-concept is identified. The scope change (S:C) - script from the AEM origin executing in the victim's browser context - is the main reason this lands above 4.0. No signals conflict; every source (Adobe PSIRT, NVD, EPSS) points the same direction: a real but low-severity, opportunistically-exploitable stored XSS.

A low-privileged AEM author or content contributor injects a malicious JavaScript payload into a vulnerable form field. When a higher-privileged user (e.g., an administrator or reviewer) later browses the page containing that field, the stored script executes in their browser under the AEM origin, enabling session-token theft or actions performed as the victim. No public exploit code is currently identified.