CVE-2025-54253

Published: Aug 5, 2025Modified: Oct 23, 2025CISA KEV

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: psirt@adobe.com (Secondary)

Description

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.

Affected (1)

Products: Adobe: Experience Manager Forms

1 product

Experience Manager Forms

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Adobe Experience Manager Forms	Up to 6.5.23.0

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (3)

https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html

Source: psirt@adobe.com

Vendor Advisory

https://slcyber.io/assetnote-security-research-center/struts-devmode-in-2025-critical-pre-auth-vulnerabilities-in-adobe-experience-manager-forms/

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54253

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.