CVE-2025-54253

criticalpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.883 · 100 %ileexploit · PoCDEEUNLRUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 3 exploits · PoC

Likely / severe?

88.3% (100th) EPSS

CVSS 10 · critical

Is it mine?

8 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2025-10-15remediate by 2025-11-05

required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-24

Adobe Experience Manager Forms Code Execution Vulnerability

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.

cvss

Technical severity, 0–10. One row per scoring source.

10.0

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.110criticalAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · psirt@adobe.comexploitability 3.9 · impact 6

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-16USCWE-863USCWE-863US

exploits (3)

Public proof-of-concept and weaponised exploit code.

affected products (8)

Products and version ranges known to be affected.

Adobe Experience Manager Forms 6.5 Forms Service Pack 18-22 <08.06.2025 hotfixall versionscert_bundDE
Adobe Experience Manager Forms 6.5 Forms Service Pack 23 <08.06.2025 hotfixall versionscert_bundDE
Adobe Experience Manager Forms≤ 6.5 Forms Service Pack 18-22 <08.06.2025 hotfixcert_bundDE
Adobe Experience Manager Forms≤ 6.5 Forms Service Pack 23 <08.06.2025 hotfixcert_bundDE
Adobe Adobe Experience Manager≤ 0 ≤6.5.23enisa_euvdEU
Adobe Systems Inc. Adobe Experience Manager (AEM) Forms on JEE≤ 6.5.0-0108fstec_bduRU
Adobe Adobe Experience Manager≤ vers:unknown/*ncsc_nlNL
adobe experience manager forms≤ 6.5.23.0nvdUScpe:2.3:a:adobe:experience_manager_forms:*:*:*:*:*:*:*:*

advisories (2)

Vendor and ecosystem advisories describing this.

NCSC-2025-0241Kwetsbaarheden verholpen in Adobe Experience ManagerNL2025-08-06csaf · ncsc_nlNL
Adobe heeft kwetsbaarheden verholpen in Adobe Experience Manager (versies 6.5.23 en eerder).
WID-SEC-W-2025-1720Adobe Experience Manager Forms: Mehrere SchwachstellenDeutsch2025-08-05csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Adobe Experience Manager Forms ausnutzen, um beliebigen Programmcode auszuführen und beliebige Dateien offenzulegen.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund ncsc_nl nvd NVD CVE.org MITRE

published 2025-08-05modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html cnnvd
https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html enisa_euvd
https://helpx.adobe.com/security/products/aem-forms/apsb25-82.htmlVendor Advisorynvd
https://slcyber.io/assetnote-security-research-center/struts-devmode-in-2025-critical-pre-auth-vulnerabilities-in-adobe-experience-manager-forms/ExploitThird Party Advisorynvd
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54253Third Party AdvisoryUS Government Resourcenvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan