Adobe Experience Manager Forms Vulnerability Actively Exploited

Critical Adobe AEM Vulnerability Exploited: CISA Warns Users

Adobe Experience Manager AEM Forms CVE-2025-54253 CISA KEV Remote Code Execution Apache Struts Cybersecurity

Edward Zhou

CEO & Co-Founder

October 17, 2025

2 min read

TL;DR

A critical misconfiguration vulnerability (CVE-2025-54253) in Adobe Experience Manager (AEM) Forms on JEE is actively exploited, allowing remote code execution. CISA has added this perfect-score flaw to its KEV catalog. Organizations must upgrade to version 6.5.0-0108 or later to patch this severe security risk.

Adobe Experience Manager Vulnerability Exploited

A misconfiguration vulnerability in Adobe Experience Manager (AEM) Forms on Java Enterprise Edition (JEE), tracked as CVE-2025-54253, is being actively exploited in the wild. The Cybersecurity and Infrastructure Security Agency (CISA) has added this flaw to its Known Exploited Vulnerabilities (KEV) catalog.

Vulnerability Details

CVE-2025-54253: A misconfiguration in AEM Forms that leaves Apache Struts "devMode" enabled in the admin UI, combined with an authentication bypass. This allows unauthenticated attackers to run expressions that the Struts framework will evaluate, potentially leading to remote code execution (RCE). The CVSS score is a perfect 10.0, indicating maximum severity.
Affected Versions: Adobe Experience Manager (AEM) Forms on JEE versions 6.5.23.0 and earlier.
Resolution: Upgrade to version 6.5.0-0108 or later.
Reported By: Shubham Shah and Adam Kues of Searchlight Cyber.

Technical Explanation

The vulnerability stems from an exposed /adminui/debug servlet. This servlet evaluates user-supplied OGNL expressions as Java code without requiring authentication or input validation, enabling attackers to execute arbitrary system commands via a crafted HTTP request, according to FireCompass.

Researchers Adam Kues and Shubham Shah at Searchlight Cyber disclosed the vulnerabilities, including CVE-2025-54254, an XML external entity (XXE) injection within AEM Forms web services.

Remediation

Adobe addressed the vulnerability in August 2025. Users are advised to upgrade to version 6.5.0-0108 or later as soon as possible. CISA has directed Federal Civilian Executive Branch (FCEB) agencies to patch their systems by November 5, 2025.

New Industry Report Defines Enterprise Maturity Benchmarks for Zero Trust Identity and Access Architecture

Discover how the new Zero Trust Maturity Model is replacing perimeter-based security with identity-centric frameworks for modern enterprise protection.

By Alan V Gutnov August 5, 2026 5 min read

CVE-2026-59726

Critical Ruflo MCP Bridge Vulnerability Enables Arbitrary Command Execution and AI Agent Hijacking

Urgent: CVE-2026-59726 'RufRoot' vulnerability exposes Ruflo AI to RCE and agent hijacking. Update to v3.16.3 immediately to prevent total system compromise.

By Divyansh Ingle August 4, 2026 4 min read

zero trust architecture maturity model

Rising Endpoint Security Breaches Drive Shift Toward Zero-Trust Architectures for Global Enterprise Remote Access

Discover why Zero Trust is the new baseline for enterprise security. Learn how to combat rising endpoint breaches and secure a distributed, hybrid workforce.

By Brandon Woo August 3, 2026 5 min read

NIST post-quantum cryptography standards

NIST Lead Andrew Regenscheid Details Strategic Roadmap for Enterprise Post-Quantum Cryptography Migration

Learn how to migrate to NIST PQC standards. Expert Andrew Regenscheid details strategies against 'harvest now, decrypt later' quantum threats in 2026.

By Alan V Gutnov July 31, 2026 4 min read