---
id: "CVE-2025-54253"
kind: "vulnerability"
aliases: ["CVE-2025-54253"]
title: "adobe experience manager forms: Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could\u2026"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Adobe Experience Manager (AEM) Forms", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "adobe experience manager forms", "fixed": [], "affected": "<= 6.5.23.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adobe-experience-manager", "aem-forms", "exploited", "java", "vendor"]
not_affected_if: ["unknown"]
published_at: "2025-08-05T17:15:29+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54253", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54253", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# adobe experience manager forms: Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could…

Adobe Experience Manager Forms (JEE edition) has an unspecified flaw that allows arbitrary code execution. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Experience Manager (AEM) Forms affected ? fixed ?
- vendor:adobe experience manager forms affected <= 6.5.23.0 fixed ?

## Fix

Apply the mitigations per Adobe's vendor instructions, or discontinue use of the product if mitigations are unavailable (per CISA required action).

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-54253
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-54253

## From the sources

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_