Adobe Experience Manager CVE-2025-64881

Exploitation requires a valid low-privileged authenticated account on the AEM instance (PR:L) with the ability to submit content into one of the vulnerable form fields, and it requires a second victim user to subsequently browse to the page rendering that stored field (UI:R). It affects AEM 6.5.23 and earlier, including AEM Cloud Service and AEM 6.5 LTS. The stored, cross-context (S:C) nature means the injected script runs in the victim's browser session rather than the attacker's; the impact is limited (C:L/I:L, no availability effect). These authentication and user-interaction prerequisites meaningfully limit real-world risk despite the network attack vector.

This is a genuine but low-priority vulnerability whose signals are internally consistent and point away from urgent action. The CVSS 3.1 base score is 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - network-reachable and low-complexity, but doubly gated by requiring low-privilege authentication (PR:L) and victim user interaction (UI:R, the victim must browse to the page). The scope change (S:C) reflects that injected script executes in the victim's browser context, but impact is only C:L/I:L with no availability effect, which is typical for a form-field stored XSS. EPSS reinforces the low-urgency picture: 0.20% probability in only the 9th percentile, i.e. among the least likely CVEs to be exploited. There is no CISA KEV listing and no public proof-of-concept identified. All signals agree - there is no conflict between CVSS, EPSS, and exploitation status. This is a real, patchable defect worth remediating in the normal Adobe quarterly cycle (APSB25-115) rather than a break-glass emergency. No SSVC decision data was provided in the input; the automatable/technical-impact framing is inferred from the CVSS vector only.

A low-privileged authenticated AEM author injects a malicious JavaScript payload into a vulnerable form field that is persisted server-side. When another user - potentially a higher-privileged administrator - later browses to the page rendering that field, the stored script executes in their browser, enabling session-token theft or actions in their AEM session. No public exploit code is identified at time of analysis, and exploitation still requires the victim to visit the affected page (UI:R).