A critical vulnerability in Adobe Experience Manager (AEM) Forms, CVE-2025-54253, is actively exploited and has been added to CISA’s KEV catalog, posing a significant remote code execution risk. Despite a patch released in August 2025, systems still vulnerable are urged to update immediately to prevent exploitation. #AdobeExperienceManager #CISAKEV
Keypoints
- CVE-2025-54253 allows unauthenticated attackers to execute remote code via misconfiguration in AEM Forms.
- The vulnerability is exploited through low-complexity, no-interaction attacks and affects versions 6.5.23.0 and earlier.
- Public proof-of-concept exploits likely accelerated active exploitation attempts prior to Adobe’s patch in August 2025.
- Federal agencies are ordered to patch affected systems by November 5, 2025, under CISA directives.
- Proper system configuration and timely updates are crucial to mitigate risks associated with Java Enterprise Edition and admin interface exposure.
Read More: https://thecyberexpress.com/cve-2025-54253/