cbcvebase.
CVE-2025-54253
published 2025-08-05

CVE-2025-54253: Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An…

PriorityP195critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2025-11-05
Exploited in the wild
EPSS
87.52%
99.7th percentile
Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.

Affected

2 ranges
VendorProductVersion rangeFixed in
adobeadobe_experience_manager<= 6.5.23
adobeexperience_manager_forms<= 6.5.23.0

Detection & IOCsextracted from sources · hover to see the quote

path/adminui/updateLicense1.do
path/adminui
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Adobe Experience Manager Forms Authentication Bypass (CVE-2025-54253)"; flow:established,to_server; http.uri; content:"/adminui/updateLicense1.do"; fast_pattern; startswith; content:"login|2e|"; content:"debug|3d|command"; reference:url,slcyber.io/assetnote-security-research-center/struts-devmode-in-2025-critical-pre-auth-vulnerabilities-in-adobe-experience-manager-forms/; reference:cve,2025-54253; classtype:web-application-attack; sid:2064047; rev:1; metadata:affected_product Adobe_Experience_Manager, attack_target Server, tls_state TLSDecrypt, created_at 2025_08_19, cve CVE_2025_54253, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_08_19, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
  • Look for HTTP requests to /adminui/updateLicense1.do containing both 'login.' and 'debug=command' parameters — this is the authentication bypass + Struts2 DevMode OGNL execution pattern.
  • CVE-2025-54253 is exploited by sending OGNL expressions through Struts2 debug parameters in HTTP requests, enabled because Struts2 development mode was left enabled by mistake.
  • The attack is unauthenticated and targets the /adminui module — monitor for unauthenticated access attempts to /adminui endpoints on AEM Forms on JEE instances.
  • Exploitation requires no user interaction and no authentication — treat any external HTTP request to /adminui/updateLicense1.do as high-priority alert.
  • Proof-of-concept exploit code is publicly available and the vulnerability is confirmed actively exploited — prioritize detection and network-level blocking of /adminui/updateLicense1.do.
  • ·The root cause is Struts2 DevMode being left enabled in production — verify and disable Struts2 development mode on all AEM Forms on JEE deployments regardless of patch status.
  • ·If immediate patching is not possible, restrict internet access to AEM Forms when deployed as a standalone application.
  • ·The Snort/ET rule requires TLS decryption to be effective, as metadata indicates tls_state TLSDecrypt — ensure TLS inspection is in place on perimeter and internal sensors.

CVSS provenance

nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vulncheck10.0CRITICAL
cisa10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.