Adobe patches critical Adobe Experience Manager Forms vulnerabilities with public PoC

Adobe Experience Manager (MS) versions 6.5.23.0 and earlier contain a critical deserialization of untrusted data flaw (CWE-502) that an attacker can trigger remotely over the network without authentication and without any user interaction. By supplying maliciously crafted serialized data to a vulnerable AEM instance, the attacker achieves arbitrary code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1: 9.8). Affected organizations are those running on-prem AEM on the 6.5 release line at 6.5.23.0 or earlier, including AEM Forms deployments referenced in related coverage of Adobe's patch release. As of the available data the flaw is not yet in CISA's KEV and there is no confirmed in-the-wild exploitation, but related news reports a public proof of concept for the AEM Forms vulnerabilities fixed in the same advisory, and a 52.9% EPSS (99th percentile) indicates a high likelihood of exploitation within 30 days.

Do: Upgrade all AEM 6.5 deployments to a service pack newer than 6.5.23.0 per Adobe's security advisory, prioritizing internet-facing author/publish instances and AEM Forms (JEE) servers given the high EPSS. Until patched, restrict network access to AEM application endpoints and review edge/WAF rules for Java deserialization attack patterns. Hunt logs for signs of exploitation, monitor for KEV addition and new PoC releases, and treat patching this 9.8-CVSS, no-authentication RCE as an urgent priority.

CVE-2025-54253 is a critical (CVSS 3.1: 10.0) misconfiguration vulnerability — classified as incorrect authorization (CWE-863) — in Adobe Experience Manager (AEM) Forms versions 6.5.23 and earlier, which the referenced public research ties to Apache Struts DevMode being exposed on AEM Forms deployments. It is triggerable over the network without authentication or user interaction by sending crafted requests to the exposed dev-mode functionality, allowing an attacker to bypass security mechanisms and execute arbitrary code. Because the exploitation scope is changed, a successful compromise can impact components beyond the vulnerable service, with high impact to confidentiality, integrity, and availability. Any organization running AEM Forms 6.5.23 or earlier — particularly internet-facing Forms servers at enterprises and government agencies — is affected. The flaw is being actively exploited in the wild: CISA added it to the KEV catalog on 2025-10-15, a public proof-of-concept is available, and EPSS assigns an 87.5% probability of exploitation within 30 days (100th percentile).

Do: Upgrade AEM Forms to a release newer than 6.5.23 using the patched service pack/security update in Adobe's security bulletin, and apply vendor-recommended mitigations (e.g., disabling or restricting access to the exposed Struts DevMode endpoints) where patching is delayed. Audit internet-facing AEM Forms instances for exposed dev-mode endpoints and review logs for signs of exploitation. Federal agencies under BOD 22-01 must apply the required mitigations per vendor instructions or discontinue use of the product by the KEV due date.

CVE-2025-54254 is an XML External Entity (XXE) injection flaw (CWE-611) in Adobe Experience Manager (AEM) Forms version 6.5.23 and earlier, caused by improper restriction of external entity references when the application processes XML input. It is exploitable over the network by an unauthenticated attacker and requires no user interaction. Successful exploitation allows arbitrary file reads from the server's local file system, and the 'scope changed' element of the CVSS score indicates impact can extend beyond the vulnerable component's security scope, potentially exposing sensitive files such as configuration data and credentials; integrity and availability are unaffected. Any organization running AEM Forms 6.5.23 or earlier is in scope, especially where Forms endpoints are reachable from the internet. This specific CVE is not in CISA KEV and has no catalogued PoC of its own, but headlines report a public PoC for the AEM Forms flaws fixed in the same Adobe advisory, the sibling AEM Forms flaw CVE-2025-54253 (CVSS 10.0) is already under active attack, and the 77.1% EPSS score (100th percentile) signals a high probability of exploitation within 30 days.

Do: Upgrade AEM Forms to a release newer than 6.5.23 by applying Adobe's current AEM/AEM Forms security update, which also addresses the actively exploited sibling flaw CVE-2025-54253. Until patched, restrict internet exposure of AEM Forms endpoints and harden XML parsing (disable external entity resolution where configurable). Review server and access logs for suspicious XML requests containing external entity or file:// references and for unexpected file reads, and prioritize patching since exploitation of the related flaw is already confirmed in the wild.