Loading story…
A critical security vulnerability, tracked as CVE-2025-54253 with a CVSS score of 10.0, has been identified in Adobe Experience Manager (AEM) Forms on JEE versions 6.5.23.0 and earlier. The flaw is a misconfiguration that exposes the /adminui/debug servlet, which evaluates user-supplied OGNL expressions as Java code without requiring authentication or input validation. This allows attackers to execute arbitrary system commands on affected servers with a single crafted HTTP request, leading to the possibility of full remote code execution. Adobe addressed the vulnerability in version 6.5.0-0108, released in early August 2025, and also patched a related issue, CVE-2025-54254, with a CVSS score of 8.6. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-54253 to its Known Exploited Vulnerabilities (KEV) catalog, confirming evidence of active exploitation in the wild. CISA has issued an emergency alert, urging all Federal Civilian Executive Branch (FCEB) agencies and other organizations to apply the necessary patches by November 5, 2025, to mitigate the risk. Security firm FireCompass highlighted the severity of the flaw, noting that the exposed endpoint can be abused without authentication, making exploitation trivial for attackers. Adobe has acknowledged the existence of a publicly available proof-of-concept for both CVE-2025-54253 and CVE-2025-54254, increasing the urgency for remediation. While specific details of real-world attacks have not been disclosed, the active exploitation status underscores the immediate threat to organizations running vulnerable AEM instances. The vulnerability's critical nature is amplified by its potential to allow attackers to gain complete control over affected systems. Organizations are strongly advised to review their deployments and ensure all relevant patches are applied without delay. The exposure of such a high-impact endpoint in a widely used enterprise content management platform raises significant concerns for both public and private sector entities. The incident demonstrates the ongoing risk posed by misconfigurations and insufficient input validation in complex web applications. Security teams should also review access logs for signs of exploitation attempts and consider additional monitoring of AEM endpoints. The rapid response from CISA and Adobe highlights the importance of coordinated vulnerability disclosure and mitigation in the face of active threats. Failure to address this vulnerability could result in severe compromise of sensitive data and business operations. The situation remains dynamic, and organizations should stay alert for further advisories or indicators of compromise related to CVE-2025-54253.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Alongside the KEV listing, CISA required Federal Civilian Executive Branch agencies to fix or mitigate CVE-2025-54253 by November 5, 2025. The directive was issued to reduce exposure to ongoing exploitation of the Adobe flaw.
On October 16, 2025, CISA added Adobe Experience Manager Forms flaw CVE-2025-54253 to its Known Exploited Vulnerabilities catalog after confirming in-the-wild exploitation. The agency highlighted the bug's maximum 10.0 CVSS score and its impact on AEM Forms on JEE deployments.
Adobe issued fixes in August 2025 for the AEM Forms on JEE vulnerabilities, including CVE-2025-54253, a misconfiguration issue that can enable unauthenticated remote code execution. The updates addressed affected versions 6.5.23.0 and earlier.
Security researchers Shubham Shah and Adam Kues reported CVE-2025-54253 and CVE-2025-54254 in Adobe Experience Manager Forms. After Adobe did not patch within 90 days, they published proof-of-concept exploit code, increasing the risk of real-world abuse.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
8 references tracked. Mallory keeps watching after this page renders.
thecyberexpress.com
Open sourcescworld.com
Open sourcesocradar.io
Open sourcesecurityaffairs.com
Open sourcesecurityonline.info
Open sourcehelpnetsecurity.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe released security updates for **Adobe Experience Manager (AEM) Forms on JEE** to fix two critical vulnerabilities, including **`CVE-2025-54253`**, a **CVSS 10.0** flaw that can allow unauthenticated remote code execution. The issue affects AEM Forms on JEE versions earlier than **6.5.0-0108** and stems from the Apache Struts developer mode debug servlet being exposed at **`/adminui/debug`** without authentication, allowing attacker-controlled **OGNL** expressions to be evaluated. Adobe’s bulletin and follow-on reporting also identified **`CVE-2025-54254`**, a **CVSS 8.6** XML External Entity (**XXE**) vulnerability that could expose sensitive data and contribute to full system compromise.
Sep 3, 2026
Adobe released security updates for 36 vulnerabilities across products including Adobe Connect, Adobe Experience Manager (AEM) Forms, Bridge, Content Credentials Rust SDK, C2PA Tool, InDesign, Premiere Pro, and Substance 3D Modeler. The fixes cover nine critical- and 17 high-severity issues, with impacts including arbitrary code execution, privilege escalation, security-feature bypass, information disclosure, and denial of service. Adobe Connect fixes include critical SQL injection, cross-site scripting, and input-validation flaws affecting Android, macOS, and Windows; `CVE-2026-75682` carries a CVSS score of 9.9 and could allow malicious code deployment and execution, while `CVE-2026-75684` can enable privilege escalation. AEM Forms also received patches for critical authorization, input-validation, and server-side request forgery issues, including code-execution flaw `CVE-2026-75745`. Adobe reports no known in-the-wild exploitation, but advises customers to apply the updates and hotfixes; Connect and AEM Forms advisories are rated priority 2, calling for remediation within 30 days.
Sep 25, 2026
Adobe released security advisories addressing multiple vulnerabilities across a range of its products, including ColdFusion, Adobe Experience Manager (AEM), DNG Software Development Kit (SDK), Acrobat, Acrobat Reader, and the Creative Cloud Desktop Application. The most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged-on user, potentially enabling attackers to install programs, modify or delete data, or create new accounts with full user rights. Affected versions span ColdFusion 2025, 2023, and 2021, AEM Cloud Service and 6.5 LTS, DNG SDK 1.7.0 and prior, Acrobat and Acrobat Reader 2020 and 2024 for both Windows and Mac, and Creative Cloud Desktop Application 6.4.0.361 and earlier. Users and administrators are strongly encouraged to review the official advisories and apply the necessary updates to mitigate risk. Threat intelligence at the time of disclosure indicated no reports of these vulnerabilities being exploited in the wild. The advisories emphasize that users with administrative privileges are at greater risk if exploited, and recommend prompt patching to reduce exposure. Organizations relying on Adobe products for document management, web application development, or digital asset workflows should prioritize these updates to prevent potential compromise through remote code execution vulnerabilities.
Jun 29, 2026