CVE-2025-54253

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-54253
Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.

10.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html Vendor Advisory
https://slcyber.io/assetnote-security-research-center/struts-devmode-in-2025-critical-pre-auth-vulnerabilities-in-adobe-experience-manager-forms/ Exploit Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54253 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

cpe:2.3:a:adobe:experience_manager_forms:*:*:*:*:*:*:*:*
History

23 Oct 2025, 14:51

Type Values Removed Values Added
References () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54253 - () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54253 - Third Party Advisory, US Government Resource

21 Oct 2025, 23:17

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54253 -

21 Oct 2025, 20:20

Type Values Removed Values Added
References
  • {'url': 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54253', 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}

21 Oct 2025, 19:21

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54253 -

17 Oct 2025, 12:36

Type Values Removed Values Added
CWE NVD-CWE-noinfo

16 Oct 2025, 19:15

Type Values Removed Values Added
CWE CWE-16 CWE-863

13 Aug 2025, 18:56

Type Values Removed Values Added
CPE cpe:2.3:a:adobe:experience_manager_forms:*:*:*:*:*:*:*:*
First Time Adobe experience Manager Forms
Adobe
References () https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html - () https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html - Vendor Advisory
References () https://slcyber.io/assetnote-security-research-center/struts-devmode-in-2025-critical-pre-auth-vulnerabilities-in-adobe-experience-manager-forms/ - () https://slcyber.io/assetnote-security-research-center/struts-devmode-in-2025-critical-pre-auth-vulnerabilities-in-adobe-experience-manager-forms/ - Exploit, Third Party Advisory
CWE NVD-CWE-noinfo

06 Aug 2025, 13:15

Type Values Removed Values Added
References
  • () https://slcyber.io/assetnote-security-research-center/struts-devmode-in-2025-critical-pre-auth-vulnerabilities-in-adobe-experience-manager-forms/ -
Summary
  • (es) Las versiones 6.5.23 y anteriores de Adobe Experience Manager se ven afectadas por una vulnerabilidad de configuración incorrecta que podría provocar la ejecución de código arbitrario. Un atacante podría aprovechar esta vulnerabilidad para eludir los mecanismos de seguridad y ejecutar código. La explotación de este problema no requiere la interacción del usuario y se modifica el alcance.

05 Aug 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-05 17:15

Updated : 2025-10-23 14:51

NVD link : CVE-2025-54253

Mitre link : CVE-2025-54253

CVE.ORG link : CVE-2025-54253

JSON object : View

Products Affected

adobe

  • experience_manager_forms
CWE
CWE-863

Incorrect Authorization