CISA Warns of Actively Exploited Adobe AEM Vulnerability (CVE-2025-54253)

CISA has issued a serious warning about a newly discovered security flaw in Adobe Experience Manager (AEM). The vulnerability, tracked as CVE-2025-54253, has received a perfect CVSS severity score of 10.0 and is already being actively exploited by attackers. Due to the high risk it poses to organizations worldwide, CISA has officially added it to its Known Exploited Vulnerabilities (KEV) Catalog.

This vulnerability allows attackers to execute arbitrary code on AEM servers, potentially giving them full control over affected systems. Since Adobe Experience Manager is widely used by large enterprises, governments, banks, and global brands to manage websites and digital forms, this threat has critical consequences for data privacy and system security.

According to Adobe, CVE-2025-54253 is a misconfiguration vulnerability affecting Adobe Experience Manager (AEM) Forms on JEE, version 6.5.23.0 and earlier. It was patched in version 6.5.0-0108, released in August 2025.

Security researchers Adam Kues and Shubham Shah of Searchlight Cyber first disclosed details of this flaw in July 2025. They described it as an:

“Authentication bypass to remote code execution chain via Struts2 devmode”

In simple terms, attackers can exploit this vulnerability without needing a password or valid login. Once they find a vulnerable system, they can run their own commands and take full control of the AEM server.

The vulnerability exists in an exposed servlet endpoint located at:

/adminui/debug

This endpoint is part of the AEM admin environment and is not supposed to be publicly accessible. However, in many cases, organizations unknowingly leave it open to the internet.

Security company FireCompass explained that this endpoint evaluates user-controlled OGNL expressions as Java code without requiring any authentication. That means an attacker can send a single malicious HTTP request to execute system-level commands on the server.

Why this is dangerous: 

 Remote code execution is possible
 Exploit works over a single HTTP request
 Gives full server control
 Can be used to install malware or steal data
 Proof-of-Concept (PoC) exploit already exists publicly

Adobe has already confirmed that proof-of-concept exploit code is publicly available, making it easier for attackers and cybercriminal groups to exploit vulnerable servers.

Along with CVE-2025-54253, Adobe also patched a second serious flaw — CVE-2025-54254. This vulnerability is rated 8.6 (High Severity) and exists in AEM Forms web services.

It is classified as an XML External Entity (XXE) Injection issue. If exploited, it could allow attackers to:

• Access sensitive internal files

• Read configuration files

• Retrieve credentials

• Attack internal systems through SSRF (Server-Side Request Forgery)

Together, both vulnerabilities create a high-risk situation for AEM customers, especially those who have not installed the latest update.

Because attackers are already exploiting CVE-2025-54253, CISA has ordered all Federal Civilian Executive Branch (FCEB) agencies to patch the vulnerability before November 5, 2025.

CISA’s alert emphasizes:

“These vulnerabilities put critical systems at immediate risk and must be remediated on priority.”

Although this directive is only mandatory for U.S. government agencies, private businesses and global organizations using Adobe Experience Manager are also strongly advised to update immediately.