CVE-2025-54253
Critical 10.0 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Adobe Experience Manager Forms Code Execution Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.
Metrics
- CVSS 3.1
-
10.0 (CRITICAL)
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - EPSS — exploit probability
- 89% (percentile: 100) as of 1 November 2026
- CWE
- CWE-863
Affected products
adobe: experience manager forms
References
- https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html Vendor Advisory
- https://slcyber.io/assetnote-security-research-center/struts-devmode-in-2025-cr… ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025… Third Party AdvisoryUS Government Resource