CVE-2025-54254

CVE-2025-54254 is an XML External Entity (XXE) injection flaw (CWE-611) in Adobe Experience Manager (AEM) Forms version 6.5.23 and earlier, caused by improper restriction of external entity references when the application processes XML input. It is exploitable over the network by an unauthenticated attacker and requires no user interaction. Successful exploitation allows arbitrary file reads from the server's local file system, and the 'scope changed' element of the CVSS score indicates impact can extend beyond the vulnerable component's security scope, potentially exposing sensitive files such as configuration data and credentials; integrity and availability are unaffected. Any organization running AEM Forms 6.5.23 or earlier is in scope, especially where Forms endpoints are reachable from the internet. This specific CVE is not in CISA KEV and has no catalogued PoC of its own, but headlines report a public PoC for the AEM Forms flaws fixed in the same Adobe advisory, the sibling AEM Forms flaw CVE-2025-54253 (CVSS 10.0) is already under active attack, and the 77.1% EPSS score (100th percentile) signals a high probability of exploitation within 30 days.

What to do: Upgrade AEM Forms to a release newer than 6.5.23 by applying Adobe's current AEM/AEM Forms security update, which also addresses the actively exploited sibling flaw CVE-2025-54253. Until patched, restrict internet exposure of AEM Forms endpoints and harden XML parsing (disable external entity resolution where configurable). Review server and access logs for suspicious XML requests containing external entity or file:// references and for unexpected file reads, and prioritize patching since exploitation of the related flaw is already confirmed in the wild.