CVE-2025-54253

critical · 10Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added 2025-10-15Remediation due 2025-11-05

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.

CVSS

88.0%

EPSS (exploit prob.)

100th

EPSS percentile

2025-08-05

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-863

Affected products

Vendor	Product	Affected versions
adobe	experience_manager_forms	<= 6.5.23.0

Check a specific version with /api/v1/cve/match.

References

https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html
https://slcyber.io/assetnote-security-research-center/struts-devmode-in-2025-critical-pre-auth-vulnerabilities-in-adobe-experience-manager-forms/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54253

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-54253