Critical severity · published Aug 5, 2025
CVE-2025-54253
Adobe Experience Manager | Incorrect Authorization (CWE-863)
In wildKEV
10.0
CVSS
88.8%
EPSS
Yes
On KEV
Description
Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)88.8% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Oct 15, 2025
Federal remediation dueNov 5, 2025
Ransomware campaign useNot known
Affected products
Which versions
AE
Adobe Experience Manager · Adobe
through 6.5.23 · source: vendor
EM
Experience Manager Forms · Adobe
through 6.5.23.0 · source: NVD
EM
Experience Manager (AEM) Forms · Adobe
All versions, or not specified · source: KEV
In the news
VulnerabilityCritical
[CISA KEV] CVE-2025-54253: Adobe Experience Manager (AEM) Forms - Adobe Experience Manager Forms Code Execution Vulnerability
Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.
EMExperience Manager (AEM) FormsCVE-2025-54253
Oct 15, 2025·CISA KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-54253
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-54253
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vendor-advisory
https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html
More from Adobe Experience Manager
6.1
CVE-2018-19726
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability
6.1
CVE-2018-19727
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability
5.4
CVE-2026-34625
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
5.4
CVE-2026-34623
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
5.4
CVE-2026-34624
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)