Loading story…
Adobe released security updates for Adobe Experience Manager (AEM) Forms on JEE to fix two critical vulnerabilities, including CVE-2025-54253, a CVSS 10.0 flaw that can allow unauthenticated remote code execution. The issue affects AEM Forms on JEE versions earlier than 6.5.0-0108 and stems from the Apache Struts developer mode debug servlet being exposed at /adminui/debug without authentication, allowing attacker-controlled OGNL expressions to be evaluated. Adobe’s bulletin and follow-on reporting also identified CVE-2025-54254, a CVSS 8.6 XML External Entity (XXE) vulnerability that could expose sensitive data and contribute to full system compromise.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
A Rapid7 Metasploit pull request added an exploit module for CVE-2025-54253 targeting Adobe AEM Forms on JEE. The module exploits the exposed Struts devMode debug servlet at /adminui/debug to achieve unauthenticated remote code execution via attacker-controlled OGNL expressions.
CSIRT.SK reported that proof-of-concept exploit code was publicly available for the Adobe Experience Manager Forms on JEE vulnerabilities, increasing the urgency of patching. The report also described CVE-2025-54253 as a devMode OGNL injection issue and CVE-2025-54254 as an XXE flaw.
Adobe published APSB25-82 security updates for Adobe Experience Manager Forms on JEE to address two critical vulnerabilities, including CVE-2025-54253 and CVE-2025-54254. CSIRT.SK reports the fixes apply to versions earlier than 6.5.0-0108 and urges administrators to update immediately.
Searchlight Cyber disclosed three critical standalone AEM Forms vulnerabilities to Adobe, including CVE-2025-49533, an insecure Java deserialization issue in GetDocumentServlet that permits remote command execution. The disclosure also covered the Struts DevMode RCE and unauthenticated XXE issues later assigned CVE-2025-54253 and CVE-2025-54254.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceslcyber.io
Open sourcecsirt.sk
Open sourcehelpx.adobe.com
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical security vulnerability, tracked as CVE-2025-54253 with a CVSS score of 10.0, has been identified in Adobe Experience Manager (AEM) Forms on JEE versions 6.5.23.0 and earlier. The flaw is a misconfiguration that exposes the /adminui/debug servlet, which evaluates user-supplied OGNL expressions as Java code without requiring authentication or input validation. This allows attackers to execute arbitrary system commands on affected servers with a single crafted HTTP request, leading to the possibility of full remote code execution. Adobe addressed the vulnerability in version 6.5.0-0108, released in early August 2025, and also patched a related issue, CVE-2025-54254, with a CVSS score of 8.6. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-54253 to its Known Exploited Vulnerabilities (KEV) catalog, confirming evidence of active exploitation in the wild. CISA has issued an emergency alert, urging all Federal Civilian Executive Branch (FCEB) agencies and other organizations to apply the necessary patches by November 5, 2025, to mitigate the risk. Security firm FireCompass highlighted the severity of the flaw, noting that the exposed endpoint can be abused without authentication, making exploitation trivial for attackers. Adobe has acknowledged the existence of a publicly available proof-of-concept for both CVE-2025-54253 and CVE-2025-54254, increasing the urgency for remediation. While specific details of real-world attacks have not been disclosed, the active exploitation status underscores the immediate threat to organizations running vulnerable AEM instances. The vulnerability's critical nature is amplified by its potential to allow attackers to gain complete control over affected systems. Organizations are strongly advised to review their deployments and ensure all relevant patches are applied without delay. The exposure of such a high-impact endpoint in a widely used enterprise content management platform raises significant concerns for both public and private sector entities. The incident demonstrates the ongoing risk posed by misconfigurations and insufficient input validation in complex web applications. Security teams should also review access logs for signs of exploitation attempts and consider additional monitoring of AEM endpoints. The rapid response from CISA and Adobe highlights the importance of coordinated vulnerability disclosure and mitigation in the face of active threats. Failure to address this vulnerability could result in severe compromise of sensitive data and business operations. The situation remains dynamic, and organizations should stay alert for further advisories or indicators of compromise related to CVE-2025-54253.
Jun 29, 2026
Adobe released security updates for 36 vulnerabilities across products including Adobe Connect, Adobe Experience Manager (AEM) Forms, Bridge, Content Credentials Rust SDK, C2PA Tool, InDesign, Premiere Pro, and Substance 3D Modeler. The fixes cover nine critical- and 17 high-severity issues, with impacts including arbitrary code execution, privilege escalation, security-feature bypass, information disclosure, and denial of service. Adobe Connect fixes include critical SQL injection, cross-site scripting, and input-validation flaws affecting Android, macOS, and Windows; `CVE-2026-75682` carries a CVSS score of 9.9 and could allow malicious code deployment and execution, while `CVE-2026-75684` can enable privilege escalation. AEM Forms also received patches for critical authorization, input-validation, and server-side request forgery issues, including code-execution flaw `CVE-2026-75745`. Adobe reports no known in-the-wild exploitation, but advises customers to apply the updates and hotfixes; Connect and AEM Forms advisories are rated priority 2, calling for remediation within 30 days.
Sep 25, 2026
Adobe released a broad set of security updates covering **Adobe Experience Manager**, **Acrobat/Reader**, **ColdFusion**, **Dreamweaver**, **InDesign**, **InCopy**, **Substance 3D Sampler**, **Format Plugins**, **Campaign Classic**, and Content Credentials SDK components, prompting alerts from national and regional CERTs including Canada’s Cyber Centre and HKCERT. The advisories span multiple high-severity issues, with affected versions including **ColdFusion 2023.19 and 2025.8 and earlier**, **Dreamweaver 21.7 and earlier**, **Campaign Classic 7.4.3 build 9394 and earlier**, and **AEM Forms JEE LTS SP1 / 6.5.24.0 and earlier**. The most serious disclosures include multiple **remote code execution** bugs in Acrobat/Reader such as `CVE-2026-47911`, `CVE-2026-47912`, `CVE-2026-47913`, `CVE-2026-47914`, `CVE-2026-47915`, `CVE-2026-47918`, and `CVE-2026-47919`, largely tied to use-after-free conditions and malicious file handling; several **ColdFusion** flaws including `CVE-2026-47928`, `CVE-2026-47929`, `CVE-2026-47930`, `CVE-2026-47931`, and `CVE-2026-47932` that can enable code execution, security feature bypass, or unauthorized read/write access; **AEM Forms JEE** stored and reflected XSS issues `CVE-2026-34691` and `CVE-2026-34693`; **Campaign Classic** issues `CVE-2026-47938` and `CVE-2026-48303` involving SSRF, privilege escalation, and possible code execution; **Dreamweaver** arbitrary file read via `CVE-2026-47907`; and **USD Fileformat Plugins** heap-based buffer overflows `CVE-2026-48291` and `CVE-2026-48292`. Adobe has issued patches for the affected products, and defenders are being urged to review the vendor bulletins and deploy updates quickly.
Jun 29, 2026