Critical Adobe Experience Manager Flaw CVE-2025-54253 Under Active Exploitation

A critical security vulnerability, tracked as CVE-2025-54253 with a CVSS score of 10.0, has been identified in Adobe Experience Manager (AEM) Forms on JEE versions 6.5.23.0 and earlier. The flaw is a misconfiguration that exposes the /adminui/debug servlet, which evaluates user-supplied OGNL expressions as Java code without requiring authentication or input validation. This allows attackers to execute arbitrary system commands on affected servers with a single crafted HTTP request, leading to the possibility of full remote code execution. Adobe addressed the vulnerability in version 6.5.0-0108, released in early August 2025, and also patched a related issue, CVE-2025-54254, with a CVSS score of 8.6. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-54253 to its Known Exploited Vulnerabilities (KEV) catalog, confirming evidence of active exploitation in the wild. CISA has issued an emergency alert, urging all Federal Civilian Executive Branch (FCEB) agencies and other organizations to apply the necessary patches by November 5, 2025, to mitigate the risk. Security firm FireCompass highlighted the severity of the flaw, noting that the exposed endpoint can be abused without authentication, making exploitation trivial for attackers. Adobe has acknowledged the existence of a publicly available proof-of-concept for both CVE-2025-54253 and CVE-2025-54254, increasing the urgency for remediation. While specific details of real-world attacks have not been disclosed, the active exploitation status underscores the immediate threat to organizations running vulnerable AEM instances. The vulnerability's critical nature is amplified by its potential to allow attackers to gain complete control over affected systems. Organizations are strongly advised to review their deployments and ensure all relevant patches are applied without delay. The exposure of such a high-impact endpoint in a widely used enterprise content management platform raises significant concerns for both public and private sector entities. The incident demonstrates the ongoing risk posed by misconfigurations and insufficient input validation in complex web applications. Security teams should also review access logs for signs of exploitation attempts and consider additional monitoring of AEM endpoints. The rapid response from CISA and Adobe highlights the importance of coordinated vulnerability disclosure and mitigation in the face of active threats. Failure to address this vulnerability could result in severe compromise of sensitive data and business operations. The situation remains dynamic, and organizations should stay alert for further advisories or indicators of compromise related to CVE-2025-54253.