CVE-2025-64565: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64565 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to execute malicious scripts in the context of a victim's browser. It affects AEM versions 6.5.23 and earlier (on-premise/LTS) and AEM Cloud Service versions prior to 2025.12.0. Adobe disclosed and patched this vulnerability on December 9, 2025. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the DOM-based variant. An attacker with low privileges can craft a malicious URL or manipulate a web page such that unsanitized input is processed by the victim's browser DOM, triggering script execution without server-side reflection. Exploitation requires user interaction — the victim must visit a crafted URL or interact with a manipulated page. No public proof-of-concept code has been identified at this time (Adobe Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the authenticated victim's browser session within AEM, potentially enabling session token theft, credential harvesting, unauthorized actions on behalf of the victim, or further phishing attacks. The scope is marked as Changed, meaning the impact can extend beyond the vulnerable component to the victim's browser environment. Confidentiality and integrity are both assessed as Low impact, with no direct availability impact (Adobe Advisory).

1. Reconnaissance: Identify AEM instances running versions 6.5.23 or earlier, or AEM Cloud Service prior to 2025.12.0, using passive reconnaissance or web fingerprinting techniques.
2. Craft malicious payload: Construct a URL or web page that injects a DOM-based XSS payload into an AEM endpoint that unsafely processes attacker-controlled input in the browser DOM (e.g., via URL fragment, query parameter, or hash value).
3. Deliver payload: Send the crafted URL to a low-privileged or authenticated AEM user via phishing email, social engineering, or embedding in a shared AEM page/content.
4. Trigger execution: When the victim visits the crafted URL or interacts with the manipulated page, the victim's browser processes the malicious DOM manipulation and executes the injected JavaScript.
5. Achieve objective: The attacker's script runs in the victim's browser session, enabling session cookie theft, credential harvesting, unauthorized AEM actions, or redirection to attacker-controlled infrastructure (Adobe Advisory).

• Network: Unusual outbound requests from victim browsers to attacker-controlled domains originating from AEM page interactions; unexpected cross-origin requests in browser network logs.
• Logs: AEM access logs showing requests to vulnerable endpoints with suspicious URL fragments, encoded characters, or unusual query parameters (e.g., %3Cscript%3E, javascript:, onerror=).
• Browser/Client: Unexpected JavaScript execution or redirects when accessing AEM pages; browser console errors related to DOM manipulation on AEM endpoints.
• Application: Anomalous AEM user activity (e.g., unauthorized content modifications, privilege changes) following user interaction with a suspicious URL.

Adobe has released patches addressing CVE-2025-64565 as part of security bulletin APSB25-115, published December 9, 2025. AEM on-premise/LTS users should upgrade to version 6.5.24.0 or later; AEM Cloud Service users are protected as of the 2025.12.0 release. No specific configuration-based workaround has been published — upgrading to the patched version is the recommended remediation. Organizations should also enforce Content Security Policy (CSP) headers on AEM deployments as a defense-in-depth measure (Adobe Advisory).

The Center for Internet Security (CIS) issued an advisory noting multiple vulnerabilities in Adobe products patched in December 2025, including those addressed in APSB25-115, recommending prompt patching (CIS Advisory). Tenable also tracked this issue in its vulnerability pipeline. No significant independent researcher commentary or social media discussion specific to CVE-2025-64565 has been identified, consistent with its medium severity rating and lack of public exploit code.