CVE-2025-54253: Critical Adobe Experience Manager Vulnerability Actively Exploited

CVE-2025-54253 is a critical vulnerability in Adobe Experience Manager that has been actively exploited in the wild, with the flaw stemming from a misconfiguration in AEM’s Struts2 DevMode involving the exposed /adminui/debug servlet. According to SOCRadar, the flaw allows unauthenticated attackers to execute arbitrary commands remotely, potentially giving them full control of affected systems.

Security researchers from Searchlight Cyber initially uncovered the issue in April 2025, alongside two other flaws, and a public PoC exploit appeared before patches were issued. The vulnerability affects AEM Forms on JEE versions 6.5.23.0 and earlier, and CISA later added CVE-2025-54253 to its Known Exploited Vulnerabilities Catalog on 15 October 2025.

Adobe released a patch for this flaw in AEM 6.5.0-0108, with mitigation steps including upgrading, restricting internet access to patched systems, monitoring for suspicious HTTP requests targeting the /adminui/debug endpoint, and reviewing logs for anomalous Java activity.