CVE-2025-54253
published 2025-08-05CVE-2025-54253: Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An…
PriorityP195critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2025-11-05
Exploited in the wild
EPSS
87.52%
99.7th percentile
Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | adobe_experience_manager | <= 6.5.23 | — |
| adobe | experience_manager_forms | <= 6.5.23.0 | — |
Detection & IOCsextracted from sources · hover to see the quote
path/adminui/updateLicense1.do
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Adobe Experience Manager Forms Authentication Bypass (CVE-2025-54253)"; flow:established,to_server; http.uri; content:"/adminui/updateLicense1.do"; fast_pattern; startswith; content:"login|2e|"; content:"debug|3d|command"; reference:url,slcyber.io/assetnote-security-research-center/struts-devmode-in-2025-critical-pre-auth-vulnerabilities-in-adobe-experience-manager-forms/; reference:cve,2025-54253; classtype:web-application-attack; sid:2064047; rev:1; metadata:affected_product Adobe_Experience_Manager, attack_target Server, tls_state TLSDecrypt, created_at 2025_08_19, cve CVE_2025_54253, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_08_19, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
- →Look for HTTP requests to /adminui/updateLicense1.do containing both 'login.' and 'debug=command' parameters — this is the authentication bypass + Struts2 DevMode OGNL execution pattern.
- →CVE-2025-54253 is exploited by sending OGNL expressions through Struts2 debug parameters in HTTP requests, enabled because Struts2 development mode was left enabled by mistake. ↗
- →The attack is unauthenticated and targets the /adminui module — monitor for unauthenticated access attempts to /adminui endpoints on AEM Forms on JEE instances. ↗
- →Exploitation requires no user interaction and no authentication — treat any external HTTP request to /adminui/updateLicense1.do as high-priority alert. ↗
- →Proof-of-concept exploit code is publicly available and the vulnerability is confirmed actively exploited — prioritize detection and network-level blocking of /adminui/updateLicense1.do. ↗
- ·The root cause is Struts2 DevMode being left enabled in production — verify and disable Struts2 development mode on all AEM Forms on JEE deployments regardless of patch status. ↗
- ·If immediate patching is not possible, restrict internet access to AEM Forms when deployed as a standalone application. ↗
- ·The Snort/ET rule requires TLS decryption to be effective, as metadata indicates tls_state TLSDecrypt — ensure TLS inspection is in place on perimeter and internal sensors.
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vulncheck10.0CRITICAL
cisa10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7mcc-8f7p-x6v7: Adobe Experience Manager versions 6
ghsa_unreviewed·2025-08-05
CVE-2025-54253 [CRITICAL] CWE-863 GHSA-7mcc-8f7p-x6v7: Adobe Experience Manager versions 6
Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.
VulnCheck
Adobe Experience Manager Forms Code Execution Vulnerability
vulncheck·2025·CVSS 10.0
CVE-2025-54253 [CRITICAL] Adobe Experience Manager Forms Code Execution Vulnerability
Adobe Experience Manager Forms Code Execution Vulnerability
Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.
Affected: Adobe Experience Manager (AEM) Forms
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-08-12&host_type=src&vulnerability=cve-2025-54253; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-08-13&host_type=src&vulnerability=cve-2025-54253; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-08-26&host_typ
CISA
Adobe Experience Manager Forms Code Execution Vulnerability
cisa·2025-10-15·CVSS 10.0
CVE-2025-54253 [CRITICAL] Adobe Experience Manager Forms Code Execution Vulnerability
Vulnerability: Adobe Experience Manager Forms Code Execution Vulnerability
Affected: Adobe Experience Manager (AEM) Forms
Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-54253
Remediation Due Date: 2025-11-05
Suricata
ET WEB_SPECIFIC_APPS Adobe Experience Manager Forms Authentication Bypass (CVE-2025-54253)
suricata·2025-08-19·CVSS 10.0
CVE-2025-54253 [CRITICAL] ET WEB_SPECIFIC_APPS Adobe Experience Manager Forms Authentication Bypass (CVE-2025-54253)
ET WEB_SPECIFIC_APPS Adobe Experience Manager Forms Authentication Bypass (CVE-2025-54253)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Adobe Experience Manager Forms Authentication Bypass (CVE-2025-54253)"; flow:established,to_server; http.uri; content:"/adminui/updateLicense1.do"; fast_pattern; startswith; content:"login|2e|"; content:"debug|3d|command"; reference:url,slcyber.io/assetnote-security-research-center/struts-devmode-in-2025-critical-pre-auth-vulnerabilities-in-adobe-experience-manager-forms/; reference:cve,2025-54253; classtype:web-application-attack; sid:2064047; rev:1; metadata:affected_product Adobe_Experience_Manager, attack_target Server, tls_state TLSDecrypt, created_at 2025_08_19, cve CVE_2025_54253, deployment Perimeter, deployment Internal, c
No public exploits indexed.
Bleepingcomputer
CISA: Maximum-severity Adobe flaw now exploited in attacks
blogs_bleepingcomputer·2025-10-16·CVSS 9.8
CVE-2025-54253 [CRITICAL] CISA: Maximum-severity Adobe flaw now exploited in attacks
## CISA: Maximum-severity Adobe flaw now exploited in attacks
## Sergiu Gatlan
CISA has warned that attackers are actively exploiting a maximum-severity vulnerability in Adobe Experience Manager to execute code on unpatched systems.
Tracked as CVE-2025-54253 , this critical security flaw stems from a misconfiguration weakness that affects Adobe Experience Manager (AEM) Forms on JEE versions 6.5.23 and earlier.
Successful exploitation can allow unauthenticated threat actors to bypass security mechanisms and execute arbitrary code remotely in low-complexity attacks that don't require user interaction.
The flaw was discovered by Adam Kues and Shubham Shah of Searchlight Cyber, who disclosed it to Adobe on April 28th, together with two other issues (CVE-2025-54254 and CVE-2025-49533).
Ho
Bleepingcomputer
Adobe issues emergency fixes for AEM Forms zero-days after PoCs released
blogs_bleepingcomputer·2025-08-05·CVSS 9.8
CVE-2025-54253 [CRITICAL] Adobe issues emergency fixes for AEM Forms zero-days after PoCs released
## Adobe issues emergency fixes for AEM Forms zero-days after PoCs released
## Lawrence Abrams
Adobe released emergency updates for two zero-day flaws in Adobe Experience Manager (AEM) Forms on JEE after a PoC exploit chain was disclosed that can be used for unauthenticated, remote code execution on vulnerable instances.
The flaws are tracked as CVE-2025-54253 and CVE-2025-54254:
CVE-2025-54253: Misconfiguration allowing arbitrary code execution. Rated "Critical" with a maximum-severity 10.0 CVSS score.
CVE-2025-54254: Improper Restriction of XML External Entity Reference (XXE) allowing arbitrary file system read. Rated "Critical" with a CVSS score of 8.6.
Adobe has fixed the flaws in the latest versions as described in this advisory .
The vulnerabilities were discovered by Shubham
Greynoiseio
NoiseLetter August 2025
blogs_greynoiseio
NoiseLetter August 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Recorded Future
October 2025 CVE Landscape
blogs_recorded_future·CVSS 9.8
[CRITICAL] October 2025 CVE Landscape
# October 2025 CVE Landscape: 32 High-Impact Vulnerabilities Demand Immediate Attention
October 2025 saw a significant escalation in vulnerability activity, with Recorded Future's Insikt Group® identifying 32 high-impact vulnerabilities, double the 16 identified in September's CVE report. Twenty-six of these vulnerabilities scored as Very Critical.
What security teams need to know:
- Microsoft dominates: Eight of 32 vulnerabilities affect Microsoft products, including a critical WSUS deserialization flaw (CVE-2025-59287) now being actively exploited
- CL0P ransomware group exploited an Oracle E-Business Suite zero-day (CVE-2025-61882) for data theft and extortion campaigns
- Legacy vulnerabilities persist: Five of the 14 RCE-enabling vulnerabilities are over a decade old, highlighting c
Recorded Future
October 2025 CVE Landscape
blogs_recorded_future·CVSS 9.8
[CRITICAL] October 2025 CVE Landscape
## October 2025 CVE Landscape: 32 High-Impact Vulnerabilities Demand Immediate Attention
October 2025 saw a significant escalation in vulnerability activity, with Recorded Future's Insikt Group® identifying 32 high-impact vulnerabilities , double the 16 identified in September's CVE report . Twenty-six of these vulnerabilities scored as Very Critical.
What security teams need to know:
Microsoft dominates: Eight of 32 vulnerabilities affect Microsoft products, including a critical WSUS deserialization flaw ( CVE-2025-59287 ) now being actively exploited
CL0P ransomware group exploited an Oracle E-Business Suite zero-day ( CVE-2025-61882 ) for data theft and extortion campaigns
Legacy vulnerabilities persist: Five of the 14 RCE-enabling vulnerabilities are over a decade old, highlightin
2025-08-05
Published
2025-10-15
Added to CISA KEV
Exploited in the wild