Adobe Experience Manager CVE-2025-64887

Requires a valid low-privileged AEM account (PR:L) - this is not unauthenticated. Exploitation additionally requires victim user interaction (UI:R): the target must visit a crafted URL or interact with a manipulated web page for the DOM-based script to execute in their browser. Impact is confined to the victim's browser context (client-side script execution, low confidentiality and integrity impact), not server-side code execution. Applies to AEM 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS. The double gating (authentication plus user interaction) meaningfully limits realistic exploitation despite the network attack vector.

This is a high-CVSS-name-but-modest-real-risk issue. The CVSS 3.1 base score of 5.4 (MEDIUM) is itself moderate, and every strong exploitation signal is negative: EPSS is 0.20% (9th percentile), placing it in the low-probability tail; the vulnerability is NOT in CISA KEV (no confirmed active exploitation); and no public POC is identified at time of analysis. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) confirms double gating - the attacker must already hold low-privilege authenticated access (PR:L) AND the victim must perform user interaction (UI:R, e.g. visiting a crafted URL). The scope change (S:C) reflects that injected script executes in the victim's browser context rather than the server, and impacts are limited to C:L/I:L with no availability impact. There are no conflicting signals here: description, CVSS, and CWE-79 all agree this is a client-side DOM-based XSS. The main verification gap is that Adobe's APSB25-115 advisory is the sole reference and no independent patch version is echoed by NVD beyond the affected-version ceiling of 6.5.23.

A low-privileged authenticated AEM author or contributor crafts a URL or manipulated web page that triggers client-side DOM sink handling in AEM, embedding malicious JavaScript. When another AEM user (e.g. a fellow author or admin) visits the crafted URL or interacts with the page, the script executes in their browser session, enabling limited session/data theft or content manipulation. No public exploit code is identified at time of analysis, and exploitation requires both authentication and victim interaction.