CVE-2025-54253criticalunder attackCWE-863

CVE-2025-54253: critical vulnerability in Adobe Experience Manager

Adobe Experience Manager | Incorrect Authorization (CWE-863)

Published · Updated

Follow this CVE+ Monitor Adobe Experience Manager+ Monitor Adobe Experience Manager Forms

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 10epss 81%
from disclosure to weapon1 day
Published on NVDAug 5
1st PoC+1d
CISA KEV+71d
Action required by CISAfederal deadline: 2025-11-05

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Adobe Experience Manager versions 6.5.23 and earlier have a security misconfiguration that allows attackers to run arbitrary code on the system without any user interaction. This is a critical flaw because it gives complete control of the affected server to an attacker.

Technical detail

A misconfiguration vulnerability in Adobe Experience Manager (AEM) 6.5.23 and earlier enables unauthorized code execution through security mechanism bypass. The vulnerability requires no user interaction and can be exploited remotely; successful exploitation grants arbitrary code execution with potential for complete system compromise and privilege escalation.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Adobe · Adobe Experience Manager
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Adobe Experience Manager

In the same product, most dangerous first.

CVE-2025-54254HIGHAdobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 53.9%CVE-2019-8086—CVE-2019-8086EPSS 22.5%CVE-2019-16469—CVE-2019-16469EPSS 17.2%CVE-2019-7964—CVE-2019-7964EPSS 10.2%CVE-2025-54248HIGHAdobe Experience Manager | Improper Input Validation (CWE-20)EPSS 7.0%CVE-2025-54252MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 6.5%