CVE-2025-54253

Published Aug 5, 2025

Last updated 6 days ago

Adobe Experience Manager

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-54253 is a misconfiguration vulnerability affecting Adobe Experience Manager (AEM) Forms on JEE versions 6.5.23 and earlier. It stems from an authentication bypass in the /adminui module combined with a misconfigured developer setting. The vulnerability exists because Struts2's development mode was mistakenly left enabled. This misconfiguration allows attackers to execute arbitrary code. Specifically, it enables the execution of OGNL expressions through debug parameters sent in HTTP requests. Exploitation of this vulnerability does not require user interaction.

Description: Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.
Source: psirt@adobe.com
NVD status: Analyzed
Products: experience_manager_forms

Risk scores

CVSS 3.1

Type: Secondary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Adobe Experience Manager Forms Code Execution Vulnerability
Exploit added on: Oct 15, 2025
Exploit action due: Nov 5, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

psirt@adobe.com: CWE-863

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:adobe:experience_manager_forms:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1449BBE4-7484-4972-8D04-BEC04C159F44",
            "versionEndIncluding": "6.5.23.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.