CVE-2025-54253Adobe Experience Manager | Incorrect Authorization (CWE-863)
Explotación conocida — Adobe Experience Manager Forms Code Execution Vulnerability
CISA confirmó el 15.10.2025 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 05.11.2025.
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-54253
Descripción
Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Adobe | Adobe Experience Manager | ≤ 6.5.23 | |
| adobe | experience manager forms | ≤ 6.5.23.0 |
Referencias y parches
- https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html vendor-advisoryVendor Advisory
- https://slcyber.io/assetnote-security-research-center/struts-devmode-in-2025-critical-pre-auth-vulnerabilitie… ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54253 Third Party AdvisoryUS Government Resource
Coincidencias CPE (NVD) (1)
cpe:2.3:a:adobe:experience_manager_forms:*:*:*:*:*:*:*:*≤ 6.5.23.0