Back to overview

CVE-2025-54253

CRITICAL KEV CISA Exploitation: ACTIVE
10.0
CVSS 3.1
Description
Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.

Metadata

CVE ID
CVE-2025-54253
State
PUBLISHED
Assigner
adobe
Reserved
2025-07-17 21:15 UTC
Published
2025-08-05 16:53 UTC
Last updated
2026-02-26 17:49 UTC
Primary CWE
CWE-863
Incorrect Authorization (CWE-863)
Vendor / Product
Adobe / Adobe Experience Manager
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
ACTIVE
Automatable
yes
Tech. Impact
total
CISA Known Exploited Vulnerability
Vulnerability name
Adobe Experience Manager Forms Code Execution Vulnerability
Vendor
Adobe
Product
Experience Manager (AEM) Forms
Added to KEV
2025-10-15
Due date
2025-11-05
Ransomware
Not known
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA description
Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.
Affected products (1)
VendorProductPlatformVersions
Adobe Adobe Experience Manager — 0 ≤ 6.5.23
Weakness (CWE)
CWESourceDescription
CWE-863 cna Incorrect Authorization (CWE-863)
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References (1)
Back to overview