by Kastro
Paper/Archive/CVE-2025-54253

CVE-2025-54253

Adobe Adobe Experience Manager — Adobe Experience Manager | Incorrect Authorization (CWE-863)

KEV · due 5 NovEPSS 89%public exploitSSVC actCVSS 10.0
critical.is priorityof 100
100
CVSS 10.0 (CNA)10.0 / 10 × 3030.0In CISA KEV+3030.0EPSS percentile 99.8.998 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.

Affected

ProductAffectedFixed inSource
Adobe Experience Manager≤ 6.5.23–CNA

Scores by source

adobe (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

advisoryhelpx.adobe.com/security/products/aem-forms/apsb25-82.htmlwriteupslcyber.io/assetnote-security-research-center/struts-devmode-in-2025-critical-pre-auth-vulnerabilities-in-adobe-experience-manager-formsrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54253kevcisa.gov/known-exploited-vulnerabilities-catalog